# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 15 2019 18:28:42 # Log Creation Date: 28.05.2019 17:23:12.292 Process: id = "1" image_name = "svhost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svhost.exe" page_root = "0x441c0000" os_pid = "0xa14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svhost.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa18 [0037.281] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0037.282] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0037.282] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0037.282] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0037.283] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0037.284] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0037.285] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0037.286] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0037.287] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0037.288] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0037.289] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0037.289] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0040.420] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0040.420] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0040.420] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0040.420] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0040.420] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0040.420] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0040.420] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0040.420] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0040.421] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0040.421] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0040.421] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0040.421] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0040.421] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0040.421] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0042.426] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0042.426] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0046.654] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0046.654] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0046.654] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0046.654] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0046.925] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0046.926] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0046.926] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0046.926] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0047.337] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0047.337] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0047.337] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0047.338] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0047.338] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0047.338] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0047.338] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0047.338] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0047.338] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0047.338] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0047.339] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0047.339] GetProcessHeap () returned 0x5e0000 [0047.339] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x5f40c8 [0047.339] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=16684194152) returned 1 [0047.339] GetTickCount () returned 0x1a4f5 [0047.339] GetCurrentProcessId () returned 0xa14 [0047.340] GetTickCount () returned 0x1a4f5 [0047.340] GetTickCount () returned 0x1a4f5 [0047.340] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x5f40f0 [0047.340] GetVersion () returned 0x1db10106 [0047.340] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x7) returned 0x5e36b0 [0047.340] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f0bd0 [0047.340] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0bd0, Size=0x20) returned 0x5f4140 [0047.340] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4140, Size=0x40) returned 0x5f46b0 [0047.340] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x5f4900 [0047.340] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q4F01WA") returned 0x0 [0047.340] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_Q4F01WA") returned 0x84 [0047.340] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5e36b0 | out: hHeap=0x5e0000) returned 1 [0047.340] lstrlenW (lpString="Global\\syncronize_") returned 18 [0047.340] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f46b0 | out: hHeap=0x5e0000) returned 1 [0047.340] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x7) returned 0x5e36b0 [0047.340] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f0bd0 [0047.340] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0bd0, Size=0x20) returned 0x5f4140 [0047.340] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4140, Size=0x40) returned 0x5f46b0 [0047.341] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x604908 [0047.341] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q4F01WU") returned 0x0 [0047.341] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_Q4F01WU") returned 0x88 [0047.341] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5e36b0 | out: hHeap=0x5e0000) returned 1 [0047.341] lstrlenW (lpString="Global\\syncronize_") returned 18 [0047.341] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f46b0 | out: hHeap=0x5e0000) returned 1 [0047.341] GetVersion () returned 0x1db10106 [0047.341] GetCurrentProcess () returned 0xffffffff [0047.341] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0047.341] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0047.341] CloseHandle (hObject=0x8c) returned 1 [0047.341] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0047.341] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0047.341] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5e36b0 [0047.341] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f0bd0 [0047.341] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0bd0, Size=0x20) returned 0x5f4140 [0047.341] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4140, Size=0x40) returned 0x5f46b0 [0047.341] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f46b0, Size=0x80) returned 0x5f46b0 [0047.341] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f46b0, Size=0x100) returned 0x5f46b0 [0047.341] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x34) returned 0x5f47b8 [0047.341] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f07c0 [0047.341] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f07d0 [0047.341] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f07e0 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x5f0bd0 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f47f8 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f0be8 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f47f8, Size=0x8) returned 0x5f47f8 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x5f0c00 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f47f8, Size=0x10) returned 0x5f47f8 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f0c18 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f0c30 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f47f8, Size=0x20) returned 0x5f47f8 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x5f0c48 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f0c60 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f07c0, Size=0x8) returned 0x5f07c0 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f07d0, Size=0x8) returned 0x5f07d0 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4820 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x5f0c78 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4830 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x5f0c90 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4830, Size=0x8) returned 0x5f4830 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614928 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4830, Size=0x10) returned 0x5f4830 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614940 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4848 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4830, Size=0x20) returned 0x5f4858 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f07c0, Size=0x10) returned 0x5f4830 [0047.342] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f07d0, Size=0x10) returned 0x5f4880 [0047.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f07c0 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x614958 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f07d0 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614970 [0047.343] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f07d0, Size=0x8) returned 0x5f07d0 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4898 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x614988 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f48a8 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6149a0 [0047.343] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f48a8, Size=0x8) returned 0x5f48a8 [0047.343] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4830, Size=0x20) returned 0x614d10 [0047.343] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4880, Size=0x20) returned 0x614d38 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4880 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x6149b8 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4830 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6149d0 [0047.343] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4830, Size=0x8) returned 0x5f4830 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x614d60 [0047.343] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x614d80 [0047.343] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0047.343] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f46b0 | out: hHeap=0x5e0000) returned 1 [0047.343] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0047.355] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6149e8 [0047.355] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6149e8, Size=0x20) returned 0x5f4348 [0047.355] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4348, Size=0x40) returned 0x5f4708 [0047.355] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4708, Size=0x80) returned 0x5f4708 [0047.355] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4708, Size=0x100) returned 0x615058 [0047.355] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6149e8 [0047.355] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6149e8, Size=0x20) returned 0x5f4348 [0047.355] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4348, Size=0x40) returned 0x5f4708 [0047.355] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4708, Size=0x80) returned 0x5f4708 [0047.355] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4708, Size=0x100) returned 0x615160 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x6149e8 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4708 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.356] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4708, Size=0x8) returned 0x5f4708 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5f4718 [0047.356] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4708, Size=0x10) returned 0x5f4738 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x5f4750 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1a) returned 0x5f4348 [0047.356] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4738, Size=0x20) returned 0x5f4770 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1c) returned 0x5f4370 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x16) returned 0x5f4798 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1a) returned 0x5f4398 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x614a18 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4708 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40) returned 0x615268 [0047.356] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4708, Size=0x8) returned 0x5f4708 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x3c) returned 0x6152b0 [0047.356] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4708, Size=0x10) returned 0x5f4738 [0047.356] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x6152f8 [0047.357] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x615318 [0047.357] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4738, Size=0x20) returned 0x615338 [0047.357] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x615360 [0047.357] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0047.357] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615058 | out: hHeap=0x5e0000) returned 1 [0047.357] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0047.357] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615160 | out: hHeap=0x5e0000) returned 1 [0047.357] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6158e0 [0047.360] EnumServicesStatusExW (in: hSCManager=0x6158e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0047.361] GetLastError () returned 0xea [0047.361] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x6191e0 [0047.361] EnumServicesStatusExW (in: hSCManager=0x6158e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6191e0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6191e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0047.362] CloseServiceHandle (hSCObject=0x6158e0) returned 1 [0047.364] lstrlenW (lpString="Appinfo") returned 7 [0047.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.364] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.364] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.364] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.364] lstrlenW (lpString="AudioSrv") returned 8 [0047.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.365] lstrlenW (lpString="BFE") returned 3 [0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.365] lstrlenW (lpString="CryptSvc") returned 8 [0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.365] lstrlenW (lpString="CscService") returned 10 [0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.365] lstrlenW (lpString="DcomLaunch") returned 10 [0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.366] lstrlenW (lpString="Dhcp") returned 4 [0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.366] lstrlenW (lpString="Dnscache") returned 8 [0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.366] lstrlenW (lpString="DPS") returned 3 [0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.367] lstrlenW (lpString="eventlog") returned 8 [0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.367] lstrlenW (lpString="EventSystem") returned 11 [0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.367] lstrlenW (lpString="gpsvc") returned 5 [0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.367] lstrlenW (lpString="iphlpsvc") returned 8 [0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.368] lstrlenW (lpString="LanmanServer") returned 12 [0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.368] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.368] lstrlenW (lpString="lmhosts") returned 7 [0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.368] lstrlenW (lpString="MMCSS") returned 5 [0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.368] lstrlenW (lpString="MpsSvc") returned 6 [0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.368] lstrlenW (lpString="Netman") returned 6 [0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.369] lstrlenW (lpString="netprofm") returned 8 [0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.369] lstrlenW (lpString="NlaSvc") returned 6 [0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.369] lstrlenW (lpString="nsi") returned 3 [0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.369] lstrlenW (lpString="PcaSvc") returned 6 [0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.369] lstrlenW (lpString="PlugPlay") returned 8 [0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.370] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.370] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.370] lstrlenW (lpString="Power") returned 5 [0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.370] lstrlenW (lpString="ProfSvc") returned 7 [0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.370] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.370] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.370] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.370] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.370] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.370] lstrlenW (lpString="RpcSs") returned 5 [0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.371] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.371] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.371] lstrlenW (lpString="SamSs") returned 5 [0047.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.371] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.371] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.371] lstrlenW (lpString="Schedule") returned 8 [0047.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.371] lstrlenW (lpString="SENS") returned 4 [0047.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.371] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.371] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.371] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.371] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.371] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.371] lstrlenW (lpString="Spooler") returned 7 [0047.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.372] lstrlenW (lpString="SysMain") returned 7 [0047.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.372] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.372] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.372] lstrlenW (lpString="Themes") returned 6 [0047.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.372] lstrlenW (lpString="TrkWks") returned 6 [0047.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.372] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.372] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.372] lstrlenW (lpString="UxSms") returned 5 [0047.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.372] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.372] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.372] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.372] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.372] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.372] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.373] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.373] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.373] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.373] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.373] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.373] lstrlenW (lpString="Winmgmt") returned 7 [0047.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.373] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.373] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.373] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.373] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6191e0 | out: hHeap=0x5e0000) returned 1 [0047.373] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0047.381] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.382] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.383] lstrlenW (lpString="System") returned 6 [0047.383] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.383] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.383] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.383] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.384] lstrlenW (lpString="smss.exe") returned 8 [0047.384] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.384] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.384] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.384] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.385] lstrlenW (lpString="csrss.exe") returned 9 [0047.385] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.385] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.385] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.385] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.386] lstrlenW (lpString="wininit.exe") returned 11 [0047.386] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.386] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.386] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0047.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0047.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0047.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0047.386] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.387] lstrlenW (lpString="csrss.exe") returned 9 [0047.387] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.387] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.387] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.387] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.388] lstrlenW (lpString="winlogon.exe") returned 12 [0047.388] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.389] lstrlenW (lpString="services.exe") returned 12 [0047.389] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.389] lstrlenW (lpString="lsass.exe") returned 9 [0047.390] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.390] lstrlenW (lpString="lsm.exe") returned 7 [0047.390] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.391] lstrlenW (lpString="svchost.exe") returned 11 [0047.391] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.392] lstrlenW (lpString="svchost.exe") returned 11 [0047.392] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.393] lstrlenW (lpString="svchost.exe") returned 11 [0047.393] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.393] lstrlenW (lpString="svchost.exe") returned 11 [0047.393] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.394] lstrlenW (lpString="svchost.exe") returned 11 [0047.394] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.395] lstrlenW (lpString="audiodg.exe") returned 11 [0047.395] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.396] lstrlenW (lpString="svchost.exe") returned 11 [0047.396] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.396] lstrlenW (lpString="svchost.exe") returned 11 [0047.396] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.397] lstrlenW (lpString="dwm.exe") returned 7 [0047.397] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.398] lstrlenW (lpString="explorer.exe") returned 12 [0047.398] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.399] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.399] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.399] lstrlenW (lpString="taskhost.exe") returned 12 [0047.399] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.400] lstrlenW (lpString="svchost.exe") returned 11 [0047.400] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.401] lstrlenW (lpString="taskeng.exe") returned 11 [0047.401] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.401] lstrlenW (lpString="taskhost.exe") returned 12 [0047.401] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0047.402] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0047.402] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0047.403] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0047.403] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0047.404] lstrlenW (lpString="rides.exe") returned 9 [0047.404] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0047.407] lstrlenW (lpString="logos.exe") returned 9 [0047.407] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0047.408] lstrlenW (lpString="blades.exe") returned 10 [0047.408] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0047.409] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0047.409] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0047.410] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0047.410] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0047.410] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0047.410] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0047.411] lstrlenW (lpString="zealand.exe") returned 11 [0047.411] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0047.412] lstrlenW (lpString="donate.exe") returned 10 [0047.412] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0047.412] lstrlenW (lpString="release_county.exe") returned 18 [0047.412] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0047.413] lstrlenW (lpString="merit.exe") returned 9 [0047.413] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0047.414] lstrlenW (lpString="controversial.exe") returned 17 [0047.414] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0047.415] lstrlenW (lpString="likelihood.exe") returned 14 [0047.415] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0047.415] lstrlenW (lpString="rugby bean.exe") returned 14 [0047.415] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0047.416] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0047.416] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0047.417] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0047.417] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0047.417] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0047.417] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0047.418] lstrlenW (lpString="frankfurt.exe") returned 13 [0047.418] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0047.419] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0047.419] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0047.419] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0047.419] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.420] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.420] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0047.421] lstrlenW (lpString="dllhost.exe") returned 11 [0047.421] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0047.421] lstrlenW (lpString="dllhost.exe") returned 11 [0047.421] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0047.422] lstrlenW (lpString="svhost.exe") returned 10 [0047.422] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 0 [0047.423] CloseHandle (hObject=0xe0) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615268 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6152b0 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6152f8 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615318 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615360 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x614a00 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4718 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4750 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4348 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4370 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4798 | out: hHeap=0x5e0000) returned 1 [0047.423] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4398 | out: hHeap=0x5e0000) returned 1 [0047.423] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x61b428 [0047.424] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x62b430 [0047.424] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.424] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x5f4398 [0047.424] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4398, Size=0x40) returned 0x6169a8 [0047.424] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.424] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x5f4398 [0047.424] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.424] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x5f4370 [0047.424] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.424] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x5f4348 [0047.424] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4348, Size=0x40) returned 0x6169f0 [0047.424] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x62b430, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svhost.exe")) returned 0x30 [0047.424] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x63b438 [0047.425] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64b440 [0047.425] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.425] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x5f4348 [0047.425] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4348, Size=0x40) returned 0x616a38 [0047.425] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616a38, Size=0x80) returned 0x615268 [0047.425] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615268, Size=0x100) returned 0x617bb0 [0047.425] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0047.425] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617bb0 | out: hHeap=0x5e0000) returned 1 [0047.425] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\svhost.exe", lpDst=0x63b438, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\svhost.exe") returned 0x1f [0047.425] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64b440 | out: hHeap=0x5e0000) returned 1 [0047.425] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b438 | out: hHeap=0x5e0000) returned 1 [0047.426] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x2040020 [0047.426] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.426] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x5f4348 [0047.426] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.426] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x615930 [0047.426] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.426] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.426] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0047.426] lstrlenW (lpString="kernel32.dll") returned 12 [0047.426] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4348 | out: hHeap=0x5e0000) returned 1 [0047.426] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.426] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615930 | out: hHeap=0x5e0000) returned 1 [0047.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0047.427] CreateFileW (lpFileName="C:\\Windows\\System32\\svhost.exe" (normalized: "c:\\windows\\system32\\svhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0047.427] ReadFile (in: hFile=0xe0, lpBuffer=0x2040020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0047.442] WriteFile (in: hFile=0xe4, lpBuffer=0x2040020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0047.445] ReadFile (in: hFile=0xe0, lpBuffer=0x2040020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0047.445] CloseHandle (hObject=0xe4) returned 1 [0047.450] CloseHandle (hObject=0xe0) returned 1 [0047.451] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.451] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x615930 [0047.451] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.451] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x6158e0 [0047.452] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.453] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.453] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0047.453] lstrlenW (lpString="kernel32.dll") returned 12 [0047.453] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6158e0 | out: hHeap=0x5e0000) returned 1 [0047.453] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.453] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615930 | out: hHeap=0x5e0000) returned 1 [0047.453] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x2040020 | out: hHeap=0x5e0000) returned 1 [0047.470] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.470] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x615930 [0047.470] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615930, Size=0x40) returned 0x616a38 [0047.470] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616a38, Size=0x80) returned 0x63b450 [0047.470] lstrlenW (lpString="C:\\Windows\\System32\\svhost.exe") returned 30 [0047.470] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0047.470] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x5c) returned 0x615268 [0047.471] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0047.471] RegSetValueExW (in: hKey=0xe0, lpValueName="svhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\svhost.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\svhost.exe") returned 0x0 [0047.471] RegCloseKey (hKey=0xe0) returned 0x0 [0047.471] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615268 | out: hHeap=0x5e0000) returned 1 [0047.471] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0047.471] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b450 | out: hHeap=0x5e0000) returned 1 [0047.471] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x63d438 [0047.471] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64d440 [0047.471] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a00 [0047.472] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a00, Size=0x20) returned 0x615930 [0047.472] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615930, Size=0x40) returned 0x616a38 [0047.472] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616a38, Size=0x80) returned 0x63b450 [0047.472] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x617bb0 [0047.472] lstrlenW (lpString="") returned 0 [0047.472] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0047.472] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8c) returned 0x617cb8 [0047.472] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0047.472] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x64d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x64d440*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0047.472] RegCloseKey (hKey=0xe0) returned 0x0 [0047.472] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617cb8 | out: hHeap=0x5e0000) returned 1 [0047.472] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0047.472] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8c) returned 0x617cb8 [0047.472] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0047.477] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x64d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0047.478] RegCloseKey (hKey=0xe4) returned 0x0 [0047.478] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617cb8 | out: hHeap=0x5e0000) returned 1 [0047.478] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0047.478] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0047.478] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617bb0 | out: hHeap=0x5e0000) returned 1 [0047.478] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svhost.exe", lpDst=0x63d438, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svhost.exe") returned 0x67 [0047.478] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64d440 | out: hHeap=0x5e0000) returned 1 [0047.478] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63d438 | out: hHeap=0x5e0000) returned 1 [0047.478] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x2040020 [0047.478] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.479] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x615930 [0047.479] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.479] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x6158e0 [0047.479] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.479] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.479] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0047.479] lstrlenW (lpString="kernel32.dll") returned 12 [0047.479] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615930 | out: hHeap=0x5e0000) returned 1 [0047.479] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.479] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6158e0 | out: hHeap=0x5e0000) returned 1 [0047.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0047.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0047.481] ReadFile (in: hFile=0xe4, lpBuffer=0x2040020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0047.497] WriteFile (in: hFile=0xe8, lpBuffer=0x2040020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0047.500] ReadFile (in: hFile=0xe4, lpBuffer=0x2040020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0047.500] CloseHandle (hObject=0xe8) returned 1 [0047.502] CloseHandle (hObject=0xe4) returned 1 [0047.502] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.502] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x6158e0 [0047.502] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.502] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x615930 [0047.502] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.502] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.503] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0047.503] lstrlenW (lpString="kernel32.dll") returned 12 [0047.503] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615930 | out: hHeap=0x5e0000) returned 1 [0047.503] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.503] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6158e0 | out: hHeap=0x5e0000) returned 1 [0047.503] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x2040020 | out: hHeap=0x5e0000) returned 1 [0047.508] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x63d438 [0047.508] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64d440 [0047.508] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.508] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x6158e0 [0047.508] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6158e0, Size=0x40) returned 0x616a38 [0047.508] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616a38, Size=0x80) returned 0x63b450 [0047.508] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x617bb0 [0047.508] lstrlenW (lpString="") returned 0 [0047.508] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0047.509] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8c) returned 0x617cb8 [0047.509] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0047.509] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x64d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0047.509] RegCloseKey (hKey=0xe4) returned 0x0 [0047.509] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617cb8 | out: hHeap=0x5e0000) returned 1 [0047.509] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0047.509] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0047.509] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617bb0 | out: hHeap=0x5e0000) returned 1 [0047.509] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svhost.exe", lpDst=0x63d438, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svhost.exe") returned 0x48 [0047.509] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64d440 | out: hHeap=0x5e0000) returned 1 [0047.509] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63d438 | out: hHeap=0x5e0000) returned 1 [0047.509] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x2040020 [0047.509] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.509] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x6158e0 [0047.509] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.510] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x615930 [0047.510] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.510] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.510] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0047.510] lstrlenW (lpString="kernel32.dll") returned 12 [0047.510] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6158e0 | out: hHeap=0x5e0000) returned 1 [0047.510] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.510] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615930 | out: hHeap=0x5e0000) returned 1 [0047.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0047.510] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\svhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0047.512] ReadFile (in: hFile=0xe4, lpBuffer=0x2040020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0047.529] WriteFile (in: hFile=0xe8, lpBuffer=0x2040020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0047.532] ReadFile (in: hFile=0xe4, lpBuffer=0x2040020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2040020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0047.532] CloseHandle (hObject=0xe8) returned 1 [0047.534] CloseHandle (hObject=0xe4) returned 1 [0047.534] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.534] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x615930 [0047.534] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.534] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x6158e0 [0047.534] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.534] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.534] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0047.534] lstrlenW (lpString="kernel32.dll") returned 12 [0047.534] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6158e0 | out: hHeap=0x5e0000) returned 1 [0047.534] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.534] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615930 | out: hHeap=0x5e0000) returned 1 [0047.534] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x2040020 | out: hHeap=0x5e0000) returned 1 [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61b428 | out: hHeap=0x5e0000) returned 1 [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b430 | out: hHeap=0x5e0000) returned 1 [0047.541] lstrlenW (lpString="%windir%\\System32") returned 17 [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6169a8 | out: hHeap=0x5e0000) returned 1 [0047.541] lstrlenW (lpString="%appdata%") returned 9 [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4398 | out: hHeap=0x5e0000) returned 1 [0047.541] lstrlenW (lpString="%sh(Startup)%") returned 13 [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4370 | out: hHeap=0x5e0000) returned 1 [0047.541] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6169f0 | out: hHeap=0x5e0000) returned 1 [0047.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.541] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x5f4370 [0047.541] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4370, Size=0x40) returned 0x6169f0 [0047.541] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6169f0, Size=0x80) returned 0x63b450 [0047.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.541] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x5f4370 [0047.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1fffc) returned 0x61b428 [0047.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x63d438 [0047.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64d440 [0047.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0047.541] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x5f4398 [0047.541] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4398, Size=0x40) returned 0x6169f0 [0047.541] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6169f0, Size=0x80) returned 0x63b4d8 [0047.541] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b4d8, Size=0x100) returned 0x617bb0 [0047.541] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617bb0 | out: hHeap=0x5e0000) returned 1 [0047.541] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x63d438, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64d440 | out: hHeap=0x5e0000) returned 1 [0047.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63d438 | out: hHeap=0x5e0000) returned 1 [0047.542] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0047.542] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0047.542] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0047.542] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0047.542] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xa28, dwThreadId=0xa2c)) returned 1 [0048.069] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0048.069] WriteFile (in: hFile=0xec, lpBuffer=0x63b450*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x63b450*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0048.069] CloseHandle (hObject=0xfc) returned 1 [0048.069] CloseHandle (hObject=0xf8) returned 1 [0048.069] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61b428 | out: hHeap=0x5e0000) returned 1 [0048.069] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0048.069] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b450 | out: hHeap=0x5e0000) returned 1 [0048.069] lstrlenW (lpString="%comspec%") returned 9 [0048.069] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4370 | out: hHeap=0x5e0000) returned 1 [0048.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0048.070] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x614a30 [0048.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x614a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0048.070] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f47a8 [0048.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5f47a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a48 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a48, Size=0x20) returned 0x5f4370 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4370, Size=0x40) returned 0x6169f0 [0048.071] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xd0) returned 0x617c28 [0048.071] GetLogicalDrives () returned 0x4 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10014) returned 0x61b428 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a48 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a48, Size=0x20) returned 0x5f4370 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4370, Size=0x40) returned 0x616a80 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616a80, Size=0x80) returned 0x63b450 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x619198 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619198, Size=0x200) returned 0x619198 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619198, Size=0x400) returned 0x619198 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619198, Size=0x800) returned 0x6197b0 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6197b0, Size=0x1000) returned 0x62b448 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x63d438 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a48 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x614b20 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4750 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x614b38 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x5f4760 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614b50 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4760, Size=0x8) returned 0x5f4760 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614b68 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4760, Size=0x10) returned 0x5f4718 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614b80 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614b98 [0048.071] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4718, Size=0x20) returned 0x617ab0 [0048.071] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614bb0 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4760 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x614bc8 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x614be0 [0048.072] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x617ab0, Size=0x40) returned 0x6152d8 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x614bf8 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x614c10 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x614c28 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x614c40 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614c58 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614c70 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x615320 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614c88 [0048.072] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6152d8, Size=0x80) returned 0x619198 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614ca0 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614cb8 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614cd0 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x614ce8 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6197c8 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x6197e0 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6197f8 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4718 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619810 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619828 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619840 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619858 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619870 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619888 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x6198a0 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6198b8 [0048.072] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619198, Size=0x100) returned 0x619198 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6198d0 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6198e8 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619900 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x619918 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619930 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619948 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5f4728 [0048.072] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619960 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619978 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619990 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x617ab0 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6199a8 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6199c0 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x617ac0 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6199d8 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x6199f0 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619a08 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619a20 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619a38 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619a50 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x619a68 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619a80 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x619a98 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619ab0 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619ac8 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619ae0 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619af8 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x617ad0 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619b10 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619b28 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619b40 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619b58 [0048.073] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619198, Size=0x200) returned 0x619198 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619b70 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x6152d8 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619b88 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619bc8 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619be0 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619bf8 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619c10 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619c28 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619c40 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619c58 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619c70 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619c88 [0048.073] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619ca0 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619cb8 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619cd0 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619ce8 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619d00 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619d18 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619d30 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619d48 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619d60 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619d78 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619d90 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x6152e8 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619da8 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619dc0 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619dd8 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x619fc8 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619df0 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619e08 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e20 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e38 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e50 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e68 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e80 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619e98 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619eb0 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619ec8 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619ee0 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619ef8 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f10 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x619f28 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f40 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f58 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f70 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x619f88 [0048.074] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c468 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c480 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c498 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x619fd8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x619fe8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c4b0 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c4c8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c4e0 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c4f8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c510 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62c528 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c540 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c558 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c570 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c588 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62c5a0 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c5b8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c5d0 [0048.075] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619198, Size=0x400) returned 0x619198 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c5e8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c600 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62c618 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c630 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c648 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c660 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62c678 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c690 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c6a8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c6c0 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x619ff8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c6d8 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62c6f0 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c708 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c720 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c738 [0048.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c750 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x62c768 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c780 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c798 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c7b0 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c7c8 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c7e0 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c7f8 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c810 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c828 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x61a008 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c868 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c880 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c898 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c8b0 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c8c8 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c8e0 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c8f8 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c910 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c928 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x62c940 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c958 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x62c970 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c988 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c9a0 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c9b8 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c9d0 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62c9e8 [0048.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62ca00 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ca18 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ca30 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ca48 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ca60 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ca78 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ca90 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62caa8 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cac0 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cad8 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62caf0 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cb08 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cb20 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cb38 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cb50 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cb68 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cb80 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cb98 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x62cbb0 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12) returned 0x615f00 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cbc8 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cbe0 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cbf8 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cc10 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cc28 [0048.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cc68 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cc80 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cc98 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ccb0 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ccc8 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cce0 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ccf8 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cd10 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cd28 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cd40 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cd58 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cd70 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cd88 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cda0 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cdb8 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62cdd0 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62cde8 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62ce00 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe) returned 0x62ce18 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62ce30 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x61a018 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ce48 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x61a028 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ce60 [0048.078] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ce78 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ce90 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62cea8 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62cec0 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62ced8 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62cef0 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf08 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf20 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62cf38 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf50 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62cf68 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x62cf80 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cf98 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x61a038 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cfb0 [0048.079] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa) returned 0x62cfc8 [0048.079] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x619198, Size=0x800) returned 0x62d450 [0048.079] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0048.080] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b448 | out: hHeap=0x5e0000) returned 1 [0048.080] lstrlenW (lpString="") returned 0 [0048.080] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62dd90 | out: hHeap=0x5e0000) returned 1 [0048.080] lstrlenW (lpString=".beets") returned 6 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4750, Size=0x8) returned 0x5f4750 [0048.080] lstrlenW (lpString=".beets") returned 6 [0048.080] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62dd90 | out: hHeap=0x5e0000) returned 1 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ddc0, Size=0x20) returned 0x5f4370 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4370, Size=0x40) returned 0x616a80 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616a80, Size=0x80) returned 0x63b450 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0a8, Size=0x8) returned 0x61a0b8 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0b8, Size=0x10) returned 0x62ddc0 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ddc0, Size=0x20) returned 0x5f4348 [0048.080] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0048.080] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b450 | out: hHeap=0x5e0000) returned 1 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ddf0, Size=0x20) returned 0x615930 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615930, Size=0x40) returned 0x616a80 [0048.080] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0048.080] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0048.080] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x616a80 | out: hHeap=0x5e0000) returned 1 [0048.080] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ddf0, Size=0x20) returned 0x615930 [0048.080] lstrlenW (lpString="Info.hta") returned 8 [0048.080] lstrlenW (lpString="Info.hta") returned 8 [0048.080] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615930 | out: hHeap=0x5e0000) returned 1 [0048.081] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x64d440, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svhost.exe")) returned 0x30 [0048.081] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64d440 | out: hHeap=0x5e0000) returned 1 [0048.081] lstrlenW (lpString="svhost.exe") returned 10 [0048.081] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4348, Size=0x40) returned 0x616a80 [0048.081] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ddf0, Size=0x20) returned 0x5f4348 [0048.081] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ddf0, Size=0x20) returned 0x615930 [0048.081] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615930, Size=0x40) returned 0x616ac8 [0048.081] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616ac8, Size=0x80) returned 0x63b450 [0048.081] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x62b448 [0048.081] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0048.081] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b448 | out: hHeap=0x5e0000) returned 1 [0048.081] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x64d440, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0048.081] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65d448 | out: hHeap=0x5e0000) returned 1 [0048.081] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64d440 | out: hHeap=0x5e0000) returned 1 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0b8, Size=0x8) returned 0x61a0a8 [0048.082] lstrlenW (lpString="%windir%;") returned 9 [0048.082] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4348 | out: hHeap=0x5e0000) returned 1 [0048.082] lstrlenW (lpString="C:\\Windows;") returned 11 [0048.082] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63d438 | out: hHeap=0x5e0000) returned 1 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62de08, Size=0x20) returned 0x5f4348 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f4348, Size=0x40) returned 0x616ac8 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616ac8, Size=0x80) returned 0x63b450 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x62b448 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0e8, Size=0x8) returned 0x61a0f8 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0f8, Size=0x10) returned 0x62de50 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62de50, Size=0x20) returned 0x5f4348 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0b8, Size=0x8) returned 0x61a0f8 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0c8, Size=0x8) returned 0x61a0b8 [0048.082] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0e8, Size=0x8) returned 0x61a108 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a108, Size=0x10) returned 0x62def8 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62def8, Size=0x20) returned 0x615930 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0f8, Size=0x10) returned 0x62def8 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0b8, Size=0x10) returned 0x62df28 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a0f8, Size=0x8) returned 0x61a0e8 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a118, Size=0x8) returned 0x61a128 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62def8, Size=0x20) returned 0x6158e0 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62df28, Size=0x20) returned 0x615840 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a138, Size=0x8) returned 0x61a148 [0048.083] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0048.083] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b448 | out: hHeap=0x5e0000) returned 1 [0048.083] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62dfa0, Size=0x20) returned 0x615958 [0048.083] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x63d438, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0048.083] lstrlenW (lpString="C:\\") returned 3 [0048.084] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.084] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63d438 | out: hHeap=0x5e0000) returned 1 [0048.084] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a178, Size=0x82) returned 0x62b9b0 [0048.084] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a198, Size=0x100) returned 0x62ba40 [0048.084] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62bb48, Size=0x104) returned 0x62bc68 [0048.084] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b560, Size=0x100) returned 0x62bd78 [0048.085] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62b9b0, Size=0x104) returned 0x62be80 [0048.085] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62ba40, Size=0x200) returned 0x62bf90 [0048.085] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61a188 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62bf90 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b5c8 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b5e8 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62e000 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b670 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62e030 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62be80 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62e018 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62bc68 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b5e0 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62bbd8 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b5f8 | out: hHeap=0x5e0000) returned 1 [0048.086] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62e018, Size=0x20) returned 0x615980 [0048.086] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615980, Size=0x40) returned 0x616ac8 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61a158 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62dfa0 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b520 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62dfd0 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62bd78 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62dfb8 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61a168 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62dfe8 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x617ec8 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x616000 | out: hHeap=0x5e0000) returned 1 [0048.086] lstrlenW (lpString="%systemdrive%") returned 13 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615958 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b450 | out: hHeap=0x5e0000) returned 1 [0048.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61a138 | out: hHeap=0x5e0000) returned 1 [0048.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x61b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62dfe8, Size=0x20) returned 0x615980 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615980, Size=0x40) returned 0x616b10 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616b10, Size=0x80) returned 0x63b450 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x62b9b0 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62b9b0, Size=0x200) returned 0x62b9b0 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62b9b0, Size=0x400) returned 0x62b9b0 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62b9b0, Size=0x800) returned 0x62b9b0 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62b9b0, Size=0x1000) returned 0x630060 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a138, Size=0x8) returned 0x61a158 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a158, Size=0x10) returned 0x62e000 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62e000, Size=0x20) returned 0x615980 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615980, Size=0x40) returned 0x616b10 [0048.087] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616b10, Size=0x80) returned 0x63b450 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x631080 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x631080, Size=0x200) returned 0x62bdb0 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62bdb0, Size=0x400) returned 0x633068 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x633068, Size=0x800) returned 0x634070 [0048.088] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0048.088] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x630060 | out: hHeap=0x5e0000) returned 1 [0048.088] lstrlenW (lpString="") returned 0 [0048.088] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x634ef0 | out: hHeap=0x5e0000) returned 1 [0048.088] lstrlenW (lpString=".beets") returned 6 [0048.088] lstrlenW (lpString=".beets") returned 6 [0048.088] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x634ef0 | out: hHeap=0x5e0000) returned 1 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x634f20, Size=0x20) returned 0x615980 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615980, Size=0x40) returned 0x616b10 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616b10, Size=0x80) returned 0x63b450 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a2d8, Size=0x8) returned 0x61a2e8 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a2e8, Size=0x10) returned 0x634f20 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x634f20, Size=0x20) returned 0x6159d0 [0048.088] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0048.088] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b450 | out: hHeap=0x5e0000) returned 1 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x634f50, Size=0x20) returned 0x6159f8 [0048.088] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6159f8, Size=0x40) returned 0x616b10 [0048.088] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0048.088] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0048.089] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x5e0000) returned 1 [0048.089] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x634f50, Size=0x20) returned 0x6159f8 [0048.089] lstrlenW (lpString="Info.hta") returned 8 [0048.089] lstrlenW (lpString="Info.hta") returned 8 [0048.089] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6159f8 | out: hHeap=0x5e0000) returned 1 [0048.089] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x65d460, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svhost.exe")) returned 0x30 [0048.089] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65d460 | out: hHeap=0x5e0000) returned 1 [0048.089] lstrlenW (lpString="svhost.exe") returned 10 [0048.089] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6159d0, Size=0x40) returned 0x616b10 [0048.089] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x634f50, Size=0x20) returned 0x6159d0 [0048.089] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x634f50, Size=0x20) returned 0x6159f8 [0048.089] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6159f8, Size=0x40) returned 0x616b58 [0048.089] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616b58, Size=0x80) returned 0x63b450 [0048.089] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x631080 [0048.089] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0048.089] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x631080 | out: hHeap=0x5e0000) returned 1 [0048.089] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x65d460, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0048.089] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x66d468 | out: hHeap=0x5e0000) returned 1 [0048.089] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65d460 | out: hHeap=0x5e0000) returned 1 [0048.089] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a2e8, Size=0x8) returned 0x61a2d8 [0048.090] lstrlenW (lpString="%windir%;") returned 9 [0048.090] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6159d0 | out: hHeap=0x5e0000) returned 1 [0048.090] lstrlenW (lpString="C:\\Windows;") returned 11 [0048.090] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64d458 | out: hHeap=0x5e0000) returned 1 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x634f68, Size=0x20) returned 0x6159d0 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6159d0, Size=0x40) returned 0x616b58 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616b58, Size=0x80) returned 0x63b450 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x631080 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a318, Size=0x8) returned 0x61a328 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a328, Size=0x10) returned 0x634fb0 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x634fb0, Size=0x20) returned 0x6159d0 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a2e8, Size=0x8) returned 0x61a328 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a2f8, Size=0x8) returned 0x61a2e8 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a318, Size=0x8) returned 0x61a338 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a338, Size=0x10) returned 0x635058 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x635058, Size=0x20) returned 0x6159f8 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a328, Size=0x10) returned 0x635058 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a2e8, Size=0x10) returned 0x630090 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a328, Size=0x8) returned 0x61a318 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a348, Size=0x8) returned 0x61a358 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x635058, Size=0x20) returned 0x615a20 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630090, Size=0x20) returned 0x615a48 [0048.090] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a368, Size=0x8) returned 0x61a378 [0048.091] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0048.091] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x631080 | out: hHeap=0x5e0000) returned 1 [0048.091] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630120, Size=0x20) returned 0x615a98 [0048.091] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x64d458, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0048.091] lstrlenW (lpString="C:\\") returned 3 [0048.091] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.091] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64d458 | out: hHeap=0x5e0000) returned 1 [0048.091] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x633080, Size=0x82) returned 0x62be88 [0048.091] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6330a0, Size=0x100) returned 0x631080 [0048.091] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62bf18, Size=0x104) returned 0x6308f0 [0048.091] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b670, Size=0x100) returned 0x631188 [0048.091] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x62be88, Size=0x104) returned 0x62be88 [0048.091] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x631080, Size=0x200) returned 0x635090 [0048.093] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x633090 | out: hHeap=0x5e0000) returned 1 [0048.093] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x635090 | out: hHeap=0x5e0000) returned 1 [0048.093] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6301c8 | out: hHeap=0x5e0000) returned 1 [0048.093] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b5e8 | out: hHeap=0x5e0000) returned 1 [0048.093] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x630180 | out: hHeap=0x5e0000) returned 1 [0048.093] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b560 | out: hHeap=0x5e0000) returned 1 [0048.093] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6301b0 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62be88 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x630198 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6308f0 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6301e0 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x630860 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6301f8 | out: hHeap=0x5e0000) returned 1 [0048.094] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x633080 [0048.094] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6301f8 [0048.094] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6301f8, Size=0x20) returned 0x615ac0 [0048.094] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615ac0, Size=0x40) returned 0x616b58 [0048.094] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6301f8 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61a388 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x630120 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62c3b8 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x630150 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x631188 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x630138 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61a398 | out: hHeap=0x5e0000) returned 1 [0048.094] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x630168 | out: hHeap=0x5e0000) returned 1 [0048.095] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x5e0000) returned 1 [0048.095] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x616120 | out: hHeap=0x5e0000) returned 1 [0048.095] lstrlenW (lpString="%systemdrive%") returned 13 [0048.095] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615a98 | out: hHeap=0x5e0000) returned 1 [0048.095] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x63b450 | out: hHeap=0x5e0000) returned 1 [0048.095] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61a368 | out: hHeap=0x5e0000) returned 1 [0048.095] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x2c) returned 0x62b560 [0048.095] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x2000) returned 0x639078 [0048.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x63d438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0048.096] WaitForMultipleObjects (nCount=0x2, lpHandles=0x617c28*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xa24 Thread: id = 4 os_tid = 0xa30 [0048.186] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630168 [0048.186] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630168, Size=0x20) returned 0x615ac0 [0048.186] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615ac0, Size=0x40) returned 0x616ba0 [0048.186] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616ba0, Size=0x80) returned 0x63b450 [0048.186] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x631188 [0048.186] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630168 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630168, Size=0x20) returned 0x615ac0 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615ac0, Size=0x40) returned 0x616ba0 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x616ba0, Size=0x80) returned 0x63b450 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x63b450, Size=0x100) returned 0x631080 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x630168 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x61a368 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630138 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a368, Size=0x8) returned 0x61a398 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x616140 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a398, Size=0x10) returned 0x630150 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x616160 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1a) returned 0x615ac0 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630150, Size=0x20) returned 0x615ae8 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1c) returned 0x615b10 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x16) returned 0x616180 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1a) returned 0x615b38 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x630150 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x61a398 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40) returned 0x616ba0 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a398, Size=0x8) returned 0x61a368 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x3c) returned 0x616be8 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x61a368, Size=0x10) returned 0x630120 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x6161a0 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x6161c0 [0048.187] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630120, Size=0x20) returned 0x615b60 [0048.187] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x62c3b8 [0048.187] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0048.187] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x631188 | out: hHeap=0x5e0000) returned 1 [0048.187] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0048.188] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x631080 | out: hHeap=0x5e0000) returned 1 [0048.188] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x615c00 [0048.188] EnumServicesStatusExW (in: hSCManager=0x615c00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0048.188] GetLastError () returned 0xea [0048.188] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x64e498 [0048.188] EnumServicesStatusExW (in: hSCManager=0x615c00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64e498, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64e498, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0048.189] CloseServiceHandle (hSCObject=0x615c00) returned 1 [0048.189] lstrlenW (lpString="Appinfo") returned 7 [0048.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.189] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.189] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.189] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.190] lstrlenW (lpString="AudioSrv") returned 8 [0048.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.190] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.190] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.190] lstrlenW (lpString="BFE") returned 3 [0048.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.190] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.190] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.190] lstrlenW (lpString="CryptSvc") returned 8 [0048.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.190] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.190] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.190] lstrlenW (lpString="CscService") returned 10 [0048.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.190] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.190] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.190] lstrlenW (lpString="DcomLaunch") returned 10 [0048.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.191] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.191] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.191] lstrlenW (lpString="Dhcp") returned 4 [0048.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.191] lstrlenW (lpString="Dnscache") returned 8 [0048.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.191] lstrlenW (lpString="DPS") returned 3 [0048.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.191] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.191] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.191] lstrlenW (lpString="eventlog") returned 8 [0048.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.192] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.192] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.192] lstrlenW (lpString="EventSystem") returned 11 [0048.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.192] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.192] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.192] lstrlenW (lpString="gpsvc") returned 5 [0048.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.192] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.192] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.192] lstrlenW (lpString="iphlpsvc") returned 8 [0048.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.192] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.192] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.192] lstrlenW (lpString="LanmanServer") returned 12 [0048.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.192] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.192] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.192] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.193] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.193] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.193] lstrlenW (lpString="lmhosts") returned 7 [0048.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.193] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.193] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.193] lstrlenW (lpString="MMCSS") returned 5 [0048.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.193] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.193] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.193] lstrlenW (lpString="MpsSvc") returned 6 [0048.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.193] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.193] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.193] lstrlenW (lpString="Netman") returned 6 [0048.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.194] lstrlenW (lpString="netprofm") returned 8 [0048.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.194] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.194] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.194] lstrlenW (lpString="NlaSvc") returned 6 [0048.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.194] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.194] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.194] lstrlenW (lpString="nsi") returned 3 [0048.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.194] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.194] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.194] lstrlenW (lpString="PcaSvc") returned 6 [0048.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.194] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.194] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.194] lstrlenW (lpString="PlugPlay") returned 8 [0048.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.194] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.195] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.195] lstrlenW (lpString="Power") returned 5 [0048.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.195] lstrlenW (lpString="ProfSvc") returned 7 [0048.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.195] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.195] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.195] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.195] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.195] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.195] lstrlenW (lpString="RpcSs") returned 5 [0048.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.195] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.195] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.196] lstrlenW (lpString="SamSs") returned 5 [0048.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.196] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.196] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.196] lstrlenW (lpString="Schedule") returned 8 [0048.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.196] lstrlenW (lpString="SENS") returned 4 [0048.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.196] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.196] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.196] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.196] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.196] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.196] lstrlenW (lpString="Spooler") returned 7 [0048.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.197] lstrlenW (lpString="SysMain") returned 7 [0048.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.197] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.197] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.197] lstrlenW (lpString="Themes") returned 6 [0048.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.197] lstrlenW (lpString="TrkWks") returned 6 [0048.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.197] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.197] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.197] lstrlenW (lpString="UxSms") returned 5 [0048.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.197] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.197] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.198] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.198] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.198] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.198] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.198] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.198] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.198] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.198] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.198] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.198] lstrlenW (lpString="Winmgmt") returned 7 [0048.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.198] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.198] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.198] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.199] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x64e498 | out: hHeap=0x5e0000) returned 1 [0048.199] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0048.201] Process32FirstW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.202] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.202] lstrlenW (lpString="System") returned 6 [0048.203] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.203] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.203] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.203] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.203] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.203] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.203] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.203] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.203] lstrlenW (lpString="smss.exe") returned 8 [0048.204] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.204] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.204] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.204] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.204] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.204] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.204] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.204] lstrlenW (lpString="csrss.exe") returned 9 [0048.204] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.205] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.205] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.205] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.205] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.205] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.205] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.205] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.205] lstrlenW (lpString="wininit.exe") returned 11 [0048.205] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.205] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.205] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.206] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0048.206] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0048.206] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0048.206] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0048.206] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.206] lstrlenW (lpString="csrss.exe") returned 9 [0048.206] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.206] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.206] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.207] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.207] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.207] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.207] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.207] lstrlenW (lpString="winlogon.exe") returned 12 [0048.208] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.208] lstrlenW (lpString="services.exe") returned 12 [0048.208] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.209] lstrlenW (lpString="lsass.exe") returned 9 [0048.209] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.210] lstrlenW (lpString="lsm.exe") returned 7 [0048.210] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.210] lstrlenW (lpString="svchost.exe") returned 11 [0048.211] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.211] lstrlenW (lpString="svchost.exe") returned 11 [0048.212] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.213] lstrlenW (lpString="svchost.exe") returned 11 [0048.213] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.213] lstrlenW (lpString="svchost.exe") returned 11 [0048.213] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.214] lstrlenW (lpString="svchost.exe") returned 11 [0048.214] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.215] lstrlenW (lpString="audiodg.exe") returned 11 [0048.215] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.216] lstrlenW (lpString="svchost.exe") returned 11 [0048.216] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.216] lstrlenW (lpString="svchost.exe") returned 11 [0048.216] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.217] lstrlenW (lpString="dwm.exe") returned 7 [0048.217] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.218] lstrlenW (lpString="explorer.exe") returned 12 [0048.218] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.219] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.219] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.472] lstrlenW (lpString="taskhost.exe") returned 12 [0049.472] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.472] lstrlenW (lpString="svchost.exe") returned 11 [0049.472] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.473] lstrlenW (lpString="taskeng.exe") returned 11 [0049.473] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.474] lstrlenW (lpString="taskhost.exe") returned 12 [0049.474] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0049.474] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0049.475] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0049.475] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0049.475] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0049.476] lstrlenW (lpString="rides.exe") returned 9 [0049.476] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0049.477] lstrlenW (lpString="logos.exe") returned 9 [0049.477] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0049.478] lstrlenW (lpString="blades.exe") returned 10 [0049.478] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0049.478] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0049.478] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0049.479] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0049.479] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0049.480] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0049.480] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0049.481] lstrlenW (lpString="zealand.exe") returned 11 [0049.481] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0049.482] lstrlenW (lpString="donate.exe") returned 10 [0049.482] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0049.483] lstrlenW (lpString="release_county.exe") returned 18 [0049.483] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0049.484] lstrlenW (lpString="merit.exe") returned 9 [0049.484] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0049.485] lstrlenW (lpString="controversial.exe") returned 17 [0049.485] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0049.485] lstrlenW (lpString="likelihood.exe") returned 14 [0049.485] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0049.486] lstrlenW (lpString="rugby bean.exe") returned 14 [0049.486] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0049.487] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0049.487] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0049.488] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0049.488] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0049.488] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0049.488] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0049.489] lstrlenW (lpString="frankfurt.exe") returned 13 [0049.489] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0049.490] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0049.490] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0049.490] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0049.490] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.491] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.491] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0049.492] lstrlenW (lpString="dllhost.exe") returned 11 [0049.492] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0049.492] lstrlenW (lpString="dllhost.exe") returned 11 [0049.493] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0049.493] lstrlenW (lpString="svhost.exe") returned 10 [0049.493] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.494] lstrlenW (lpString="cmd.exe") returned 7 [0049.494] Process32NextW (in: hSnapshot=0x118, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0049.494] CloseHandle (hObject=0x118) returned 1 [0049.494] Sleep (dwMilliseconds=0x1f4) [0050.916] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x65fe78 [0050.917] EnumServicesStatusExW (in: hSCManager=0x65fe78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0050.917] GetLastError () returned 0xea [0050.917] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x660780 [0050.917] EnumServicesStatusExW (in: hSCManager=0x65fe78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x660780, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x660780, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0050.918] CloseServiceHandle (hSCObject=0x65fe78) returned 1 [0050.918] lstrlenW (lpString="Appinfo") returned 7 [0050.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.918] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.918] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.918] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.918] lstrlenW (lpString="AudioSrv") returned 8 [0050.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.918] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.918] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.918] lstrlenW (lpString="BFE") returned 3 [0050.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.919] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.919] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.919] lstrlenW (lpString="CryptSvc") returned 8 [0050.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.919] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.919] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.919] lstrlenW (lpString="CscService") returned 10 [0050.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.919] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.919] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.919] lstrlenW (lpString="DcomLaunch") returned 10 [0050.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.919] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.919] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.919] lstrlenW (lpString="Dhcp") returned 4 [0050.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.920] lstrlenW (lpString="Dnscache") returned 8 [0050.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.920] lstrlenW (lpString="DPS") returned 3 [0050.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.920] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.920] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.920] lstrlenW (lpString="eventlog") returned 8 [0050.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.920] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.920] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.920] lstrlenW (lpString="EventSystem") returned 11 [0050.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.920] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.920] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.921] lstrlenW (lpString="gpsvc") returned 5 [0050.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.921] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.921] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.921] lstrlenW (lpString="iphlpsvc") returned 8 [0050.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.921] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.921] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.921] lstrlenW (lpString="LanmanServer") returned 12 [0050.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.921] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.921] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.921] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.921] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.921] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.921] lstrlenW (lpString="lmhosts") returned 7 [0050.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.922] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.922] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.922] lstrlenW (lpString="MMCSS") returned 5 [0050.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.922] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.922] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.922] lstrlenW (lpString="MpsSvc") returned 6 [0050.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.922] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.922] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.922] lstrlenW (lpString="Netman") returned 6 [0050.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.922] lstrlenW (lpString="netprofm") returned 8 [0050.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.922] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.922] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.922] lstrlenW (lpString="NlaSvc") returned 6 [0050.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.923] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.923] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.923] lstrlenW (lpString="nsi") returned 3 [0050.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.923] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.923] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.923] lstrlenW (lpString="PcaSvc") returned 6 [0050.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.923] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.923] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.923] lstrlenW (lpString="PlugPlay") returned 8 [0050.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.923] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.923] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.923] lstrlenW (lpString="Power") returned 5 [0050.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.924] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.924] lstrlenW (lpString="ProfSvc") returned 7 [0050.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.924] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.924] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.924] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.924] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.924] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.924] lstrlenW (lpString="RpcSs") returned 5 [0050.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.924] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.924] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.924] lstrlenW (lpString="SamSs") returned 5 [0050.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.924] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.924] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.924] lstrlenW (lpString="Schedule") returned 8 [0050.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.925] lstrlenW (lpString="SENS") returned 4 [0050.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.925] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.925] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.925] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.925] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.925] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.925] lstrlenW (lpString="Spooler") returned 7 [0050.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.925] lstrlenW (lpString="SysMain") returned 7 [0050.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.925] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.926] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.926] lstrlenW (lpString="Themes") returned 6 [0050.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.926] lstrlenW (lpString="TrkWks") returned 6 [0050.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.926] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.926] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.926] lstrlenW (lpString="UxSms") returned 5 [0050.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.926] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.926] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.926] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.926] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.926] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.927] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.927] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.927] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.927] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.927] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.927] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.927] lstrlenW (lpString="Winmgmt") returned 7 [0050.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.927] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.927] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.927] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.927] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x660780 | out: hHeap=0x5e0000) returned 1 [0050.928] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x14c [0050.930] Process32FirstW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.931] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.932] lstrlenW (lpString="System") returned 6 [0050.932] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.932] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.932] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.932] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.932] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.932] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.932] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.932] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.933] lstrlenW (lpString="smss.exe") returned 8 [0050.934] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.934] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.934] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.934] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.934] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.934] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.934] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.934] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.935] lstrlenW (lpString="csrss.exe") returned 9 [0050.935] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.935] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.935] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.935] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.935] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.935] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.935] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.935] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.936] lstrlenW (lpString="wininit.exe") returned 11 [0050.936] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.936] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.936] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.936] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0050.936] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0050.936] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0050.936] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0050.936] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.937] lstrlenW (lpString="csrss.exe") returned 9 [0050.937] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.937] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.937] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.937] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.938] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.938] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.938] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.939] lstrlenW (lpString="winlogon.exe") returned 12 [0050.939] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.939] lstrlenW (lpString="services.exe") returned 12 [0050.939] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.940] lstrlenW (lpString="lsass.exe") returned 9 [0050.940] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.941] lstrlenW (lpString="lsm.exe") returned 7 [0050.941] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.942] lstrlenW (lpString="svchost.exe") returned 11 [0050.942] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.943] lstrlenW (lpString="svchost.exe") returned 11 [0050.943] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.944] lstrlenW (lpString="svchost.exe") returned 11 [0050.944] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.945] lstrlenW (lpString="svchost.exe") returned 11 [0050.945] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.946] lstrlenW (lpString="svchost.exe") returned 11 [0050.946] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.946] lstrlenW (lpString="audiodg.exe") returned 11 [0050.946] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.947] lstrlenW (lpString="svchost.exe") returned 11 [0050.947] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.948] lstrlenW (lpString="svchost.exe") returned 11 [0050.948] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.949] lstrlenW (lpString="dwm.exe") returned 7 [0050.949] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.950] lstrlenW (lpString="explorer.exe") returned 12 [0050.950] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.951] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.951] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.952] lstrlenW (lpString="taskhost.exe") returned 12 [0050.952] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.952] lstrlenW (lpString="svchost.exe") returned 11 [0050.953] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.953] lstrlenW (lpString="taskeng.exe") returned 11 [0050.953] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.954] lstrlenW (lpString="taskhost.exe") returned 12 [0050.954] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0050.955] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0050.955] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0050.957] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0050.958] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0050.958] lstrlenW (lpString="rides.exe") returned 9 [0050.958] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0050.959] lstrlenW (lpString="logos.exe") returned 9 [0050.959] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0050.960] lstrlenW (lpString="blades.exe") returned 10 [0050.960] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0050.961] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0050.961] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0050.962] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0050.962] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0050.963] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0050.964] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0050.964] lstrlenW (lpString="zealand.exe") returned 11 [0050.964] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0050.965] lstrlenW (lpString="donate.exe") returned 10 [0050.965] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0050.966] lstrlenW (lpString="release_county.exe") returned 18 [0050.966] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0050.967] lstrlenW (lpString="merit.exe") returned 9 [0050.967] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0050.968] lstrlenW (lpString="controversial.exe") returned 17 [0050.968] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0050.969] lstrlenW (lpString="likelihood.exe") returned 14 [0050.969] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0050.970] lstrlenW (lpString="rugby bean.exe") returned 14 [0050.970] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0050.970] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0050.970] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0050.971] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0050.971] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0050.972] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0050.972] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0050.973] lstrlenW (lpString="frankfurt.exe") returned 13 [0050.973] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0050.974] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0050.974] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0050.975] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0050.975] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.976] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.976] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0050.976] lstrlenW (lpString="dllhost.exe") returned 11 [0050.976] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0050.977] lstrlenW (lpString="dllhost.exe") returned 11 [0050.977] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0050.978] lstrlenW (lpString="svhost.exe") returned 10 [0050.978] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.979] lstrlenW (lpString="cmd.exe") returned 7 [0050.979] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.980] lstrlenW (lpString="conhost.exe") returned 11 [0050.980] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0050.981] lstrlenW (lpString="mode.com") returned 8 [0050.981] Process32NextW (in: hSnapshot=0x14c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0050.982] CloseHandle (hObject=0x14c) returned 1 [0050.982] Sleep (dwMilliseconds=0x1f4) [0052.415] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660008 [0052.415] EnumServicesStatusExW (in: hSCManager=0x660008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0052.416] GetLastError () returned 0xea [0052.416] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x3ee1060 [0052.416] EnumServicesStatusExW (in: hSCManager=0x660008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ee1060, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ee1060, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0052.417] CloseServiceHandle (hSCObject=0x660008) returned 1 [0052.417] lstrlenW (lpString="Appinfo") returned 7 [0052.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.417] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.417] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.417] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.417] lstrlenW (lpString="AudioSrv") returned 8 [0052.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.418] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.418] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.418] lstrlenW (lpString="BFE") returned 3 [0052.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.418] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.418] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.418] lstrlenW (lpString="CryptSvc") returned 8 [0052.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.418] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.418] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.418] lstrlenW (lpString="CscService") returned 10 [0052.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.418] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.418] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.419] lstrlenW (lpString="DcomLaunch") returned 10 [0052.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.419] lstrlenW (lpString="Dhcp") returned 4 [0052.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.419] lstrlenW (lpString="Dnscache") returned 8 [0052.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.419] lstrlenW (lpString="DPS") returned 3 [0052.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.419] lstrlenW (lpString="eventlog") returned 8 [0052.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.420] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.420] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.420] lstrlenW (lpString="EventSystem") returned 11 [0052.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.420] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.420] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.420] lstrlenW (lpString="gpsvc") returned 5 [0052.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.420] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.420] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.420] lstrlenW (lpString="iphlpsvc") returned 8 [0052.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.420] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.421] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.421] lstrlenW (lpString="LanmanServer") returned 12 [0052.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.421] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.421] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.421] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.421] lstrlenW (lpString="lmhosts") returned 7 [0052.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.421] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.421] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.421] lstrlenW (lpString="MMCSS") returned 5 [0052.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.421] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.421] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.422] lstrlenW (lpString="MpsSvc") returned 6 [0052.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.422] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.422] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.422] lstrlenW (lpString="Netman") returned 6 [0052.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.422] lstrlenW (lpString="netprofm") returned 8 [0052.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.422] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.422] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.422] lstrlenW (lpString="NlaSvc") returned 6 [0052.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.422] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.422] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.422] lstrlenW (lpString="nsi") returned 3 [0052.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.423] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.423] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.423] lstrlenW (lpString="PcaSvc") returned 6 [0052.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.423] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.423] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.423] lstrlenW (lpString="PlugPlay") returned 8 [0052.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.423] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.423] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.423] lstrlenW (lpString="Power") returned 5 [0052.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.424] lstrlenW (lpString="ProfSvc") returned 7 [0052.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.424] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.424] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.424] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.424] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.424] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.424] lstrlenW (lpString="RpcSs") returned 5 [0052.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.425] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.425] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.425] lstrlenW (lpString="SamSs") returned 5 [0052.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.425] lstrlenW (lpString="Schedule") returned 8 [0052.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.425] lstrlenW (lpString="SENS") returned 4 [0052.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.425] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.426] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.426] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.426] lstrlenW (lpString="Spooler") returned 7 [0052.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.426] lstrlenW (lpString="SysMain") returned 7 [0052.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.426] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.426] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.426] lstrlenW (lpString="Themes") returned 6 [0052.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.427] lstrlenW (lpString="TrkWks") returned 6 [0052.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.427] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.427] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.427] lstrlenW (lpString="UxSms") returned 5 [0052.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.427] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.427] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.427] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.427] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.427] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.427] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.427] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.428] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.428] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.428] lstrlenW (lpString="Winmgmt") returned 7 [0052.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.428] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.428] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.428] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.428] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ee1060 | out: hHeap=0x5e0000) returned 1 [0052.428] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0052.431] Process32FirstW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.432] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.432] lstrlenW (lpString="System") returned 6 [0052.432] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.433] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.433] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.433] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.436] lstrlenW (lpString="smss.exe") returned 8 [0052.436] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.436] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.436] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.436] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.436] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.436] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.436] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.436] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.437] lstrlenW (lpString="csrss.exe") returned 9 [0052.437] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.437] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.437] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.437] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.437] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.438] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.508] lstrlenW (lpString="wininit.exe") returned 11 [0052.508] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.508] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.508] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0052.508] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0052.508] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0052.508] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0052.508] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.509] lstrlenW (lpString="csrss.exe") returned 9 [0052.509] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.510] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.510] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.510] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.510] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.510] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.510] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.511] lstrlenW (lpString="winlogon.exe") returned 12 [0052.511] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.512] lstrlenW (lpString="services.exe") returned 12 [0052.512] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.513] lstrlenW (lpString="lsass.exe") returned 9 [0052.513] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.514] lstrlenW (lpString="lsm.exe") returned 7 [0052.514] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.516] lstrlenW (lpString="svchost.exe") returned 11 [0052.516] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.517] lstrlenW (lpString="svchost.exe") returned 11 [0052.517] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.518] lstrlenW (lpString="svchost.exe") returned 11 [0052.518] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.519] lstrlenW (lpString="svchost.exe") returned 11 [0052.519] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.520] lstrlenW (lpString="svchost.exe") returned 11 [0052.520] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.520] lstrlenW (lpString="audiodg.exe") returned 11 [0052.520] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.521] lstrlenW (lpString="svchost.exe") returned 11 [0052.521] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.522] lstrlenW (lpString="svchost.exe") returned 11 [0052.522] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.648] lstrlenW (lpString="dwm.exe") returned 7 [0052.648] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.649] lstrlenW (lpString="explorer.exe") returned 12 [0052.649] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.650] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.650] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.695] lstrlenW (lpString="taskhost.exe") returned 12 [0052.695] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.696] lstrlenW (lpString="svchost.exe") returned 11 [0052.696] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.697] lstrlenW (lpString="taskeng.exe") returned 11 [0052.697] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.698] lstrlenW (lpString="taskhost.exe") returned 12 [0052.698] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0052.699] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0052.699] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0052.700] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0052.700] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0052.701] lstrlenW (lpString="rides.exe") returned 9 [0052.701] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0052.703] lstrlenW (lpString="logos.exe") returned 9 [0052.703] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0052.704] lstrlenW (lpString="blades.exe") returned 10 [0052.704] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0052.705] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0052.705] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0052.706] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0052.706] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0052.707] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0052.707] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0052.708] lstrlenW (lpString="zealand.exe") returned 11 [0052.708] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0052.710] lstrlenW (lpString="donate.exe") returned 10 [0052.710] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0052.711] lstrlenW (lpString="release_county.exe") returned 18 [0052.711] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0052.712] lstrlenW (lpString="merit.exe") returned 9 [0052.712] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0052.713] lstrlenW (lpString="controversial.exe") returned 17 [0052.713] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0052.713] lstrlenW (lpString="likelihood.exe") returned 14 [0052.713] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0052.714] lstrlenW (lpString="rugby bean.exe") returned 14 [0052.714] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0052.715] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0052.715] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0052.716] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0052.716] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0052.717] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0052.717] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0052.719] lstrlenW (lpString="frankfurt.exe") returned 13 [0052.719] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0052.720] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0052.720] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0052.721] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0052.721] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.722] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.722] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0052.723] lstrlenW (lpString="dllhost.exe") returned 11 [0052.723] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0052.724] lstrlenW (lpString="dllhost.exe") returned 11 [0052.724] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0052.725] lstrlenW (lpString="svhost.exe") returned 10 [0052.725] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.024] lstrlenW (lpString="cmd.exe") returned 7 [0053.024] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.025] lstrlenW (lpString="conhost.exe") returned 11 [0053.025] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0053.025] lstrlenW (lpString="mode.com") returned 8 [0053.025] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0053.026] CloseHandle (hObject=0x190) returned 1 [0053.026] Sleep (dwMilliseconds=0x1f4) [0053.650] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660008 [0053.651] EnumServicesStatusExW (in: hSCManager=0x660008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0053.651] GetLastError () returned 0xea [0053.651] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x3960838 [0053.651] EnumServicesStatusExW (in: hSCManager=0x660008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3960838, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3960838, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0053.654] CloseServiceHandle (hSCObject=0x660008) returned 1 [0053.654] lstrlenW (lpString="Appinfo") returned 7 [0053.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.655] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.655] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.655] lstrlenW (lpString="AudioSrv") returned 8 [0053.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.655] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.655] lstrlenW (lpString="BFE") returned 3 [0053.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.655] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.655] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.655] lstrlenW (lpString="CryptSvc") returned 8 [0053.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.655] lstrlenW (lpString="CscService") returned 10 [0053.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.656] lstrlenW (lpString="DcomLaunch") returned 10 [0053.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.656] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.656] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.656] lstrlenW (lpString="Dhcp") returned 4 [0053.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.656] lstrlenW (lpString="Dnscache") returned 8 [0053.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.656] lstrlenW (lpString="DPS") returned 3 [0053.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.656] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.656] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.656] lstrlenW (lpString="eventlog") returned 8 [0053.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.657] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.657] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.657] lstrlenW (lpString="EventSystem") returned 11 [0053.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.657] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.657] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.657] lstrlenW (lpString="gpsvc") returned 5 [0053.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.657] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.657] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.657] lstrlenW (lpString="iphlpsvc") returned 8 [0053.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.657] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.657] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.657] lstrlenW (lpString="LanmanServer") returned 12 [0053.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.657] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.658] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.658] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.658] lstrlenW (lpString="lmhosts") returned 7 [0053.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.658] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.658] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.658] lstrlenW (lpString="MMCSS") returned 5 [0053.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.658] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.658] lstrlenW (lpString="MpsSvc") returned 6 [0053.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.658] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.658] lstrlenW (lpString="Netman") returned 6 [0053.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.659] lstrlenW (lpString="netprofm") returned 8 [0053.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.659] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.659] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.659] lstrlenW (lpString="NlaSvc") returned 6 [0053.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.659] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.659] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.659] lstrlenW (lpString="nsi") returned 3 [0053.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.659] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.659] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.659] lstrlenW (lpString="PcaSvc") returned 6 [0053.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.659] lstrlenW (lpString="PlugPlay") returned 8 [0053.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.660] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.660] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.660] lstrlenW (lpString="Power") returned 5 [0053.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.660] lstrlenW (lpString="ProfSvc") returned 7 [0053.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.660] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.660] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.660] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.660] lstrlenW (lpString="RpcSs") returned 5 [0053.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.660] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.660] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.660] lstrlenW (lpString="SamSs") returned 5 [0053.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.661] lstrlenW (lpString="Schedule") returned 8 [0053.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.661] lstrlenW (lpString="SENS") returned 4 [0053.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.661] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.661] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.661] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.662] lstrlenW (lpString="Spooler") returned 7 [0053.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.662] lstrlenW (lpString="SysMain") returned 7 [0053.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.662] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.662] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.662] lstrlenW (lpString="Themes") returned 6 [0053.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.663] lstrlenW (lpString="TrkWks") returned 6 [0053.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.663] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.663] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.663] lstrlenW (lpString="UxSms") returned 5 [0053.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.663] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.663] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.663] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.663] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.663] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.663] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.663] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.663] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.663] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.664] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.664] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.664] lstrlenW (lpString="Winmgmt") returned 7 [0053.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.664] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.664] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.664] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.664] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3960838 | out: hHeap=0x5e0000) returned 1 [0053.664] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0053.843] Process32FirstW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.844] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.844] lstrlenW (lpString="System") returned 6 [0053.844] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.844] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.845] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.845] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.845] lstrlenW (lpString="smss.exe") returned 8 [0053.845] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.846] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.846] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.846] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.847] lstrlenW (lpString="csrss.exe") returned 9 [0053.847] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.847] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.847] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.847] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.847] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.847] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.847] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.847] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.848] lstrlenW (lpString="wininit.exe") returned 11 [0053.848] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.848] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.848] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.848] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0053.848] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0053.848] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0053.848] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0053.848] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.849] lstrlenW (lpString="csrss.exe") returned 9 [0053.849] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.849] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.849] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.849] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.849] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.849] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.849] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.850] lstrlenW (lpString="winlogon.exe") returned 12 [0053.850] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.851] lstrlenW (lpString="services.exe") returned 12 [0053.851] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.852] lstrlenW (lpString="lsass.exe") returned 9 [0053.852] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.853] lstrlenW (lpString="lsm.exe") returned 7 [0053.853] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.854] lstrlenW (lpString="svchost.exe") returned 11 [0053.854] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.854] lstrlenW (lpString="svchost.exe") returned 11 [0053.854] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.855] lstrlenW (lpString="svchost.exe") returned 11 [0053.855] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.856] lstrlenW (lpString="svchost.exe") returned 11 [0053.856] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.856] lstrlenW (lpString="svchost.exe") returned 11 [0053.856] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.857] lstrlenW (lpString="audiodg.exe") returned 11 [0053.857] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.857] lstrlenW (lpString="svchost.exe") returned 11 [0053.858] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.858] lstrlenW (lpString="svchost.exe") returned 11 [0053.858] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.859] lstrlenW (lpString="dwm.exe") returned 7 [0053.859] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.860] lstrlenW (lpString="explorer.exe") returned 12 [0053.860] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.860] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.860] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.861] lstrlenW (lpString="taskhost.exe") returned 12 [0053.861] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.862] lstrlenW (lpString="svchost.exe") returned 11 [0053.862] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.863] lstrlenW (lpString="taskeng.exe") returned 11 [0053.863] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.863] lstrlenW (lpString="taskhost.exe") returned 12 [0053.864] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0054.074] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0054.074] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0054.076] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0054.076] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0054.076] lstrlenW (lpString="rides.exe") returned 9 [0054.077] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0054.077] lstrlenW (lpString="logos.exe") returned 9 [0054.077] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0054.078] lstrlenW (lpString="blades.exe") returned 10 [0054.078] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0054.080] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0054.080] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0054.080] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0054.080] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0054.081] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0054.081] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0054.082] lstrlenW (lpString="zealand.exe") returned 11 [0054.082] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0054.083] lstrlenW (lpString="donate.exe") returned 10 [0054.083] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0054.084] lstrlenW (lpString="release_county.exe") returned 18 [0054.084] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0054.085] lstrlenW (lpString="merit.exe") returned 9 [0054.085] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0054.085] lstrlenW (lpString="controversial.exe") returned 17 [0054.085] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0054.086] lstrlenW (lpString="likelihood.exe") returned 14 [0054.086] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0054.087] lstrlenW (lpString="rugby bean.exe") returned 14 [0054.087] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0054.088] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0054.088] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0054.089] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0054.089] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0054.145] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0054.146] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0054.147] lstrlenW (lpString="frankfurt.exe") returned 13 [0054.147] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0054.147] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0054.147] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0054.148] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0054.148] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.149] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.149] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.150] lstrlenW (lpString="dllhost.exe") returned 11 [0054.150] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.151] lstrlenW (lpString="dllhost.exe") returned 11 [0054.151] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0054.152] lstrlenW (lpString="svhost.exe") returned 10 [0054.152] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.153] lstrlenW (lpString="cmd.exe") returned 7 [0054.153] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.153] lstrlenW (lpString="conhost.exe") returned 11 [0054.154] Process32NextW (in: hSnapshot=0x19c, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0054.154] CloseHandle (hObject=0x19c) returned 1 [0054.155] Sleep (dwMilliseconds=0x1f4) [0055.897] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6601e8 [0055.897] EnumServicesStatusExW (in: hSCManager=0x6601e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0055.898] GetLastError () returned 0xea [0055.898] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x3f6d0a8 [0055.898] EnumServicesStatusExW (in: hSCManager=0x6601e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f6d0a8, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f6d0a8, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0055.898] CloseServiceHandle (hSCObject=0x6601e8) returned 1 [0055.899] lstrlenW (lpString="Appinfo") returned 7 [0055.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.899] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.899] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.899] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.899] lstrlenW (lpString="AudioSrv") returned 8 [0055.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.899] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.899] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.899] lstrlenW (lpString="BFE") returned 3 [0055.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.899] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.899] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.899] lstrlenW (lpString="CryptSvc") returned 8 [0055.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.900] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.900] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.900] lstrlenW (lpString="CscService") returned 10 [0055.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.900] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.900] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.900] lstrlenW (lpString="DcomLaunch") returned 10 [0055.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.900] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.900] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.900] lstrlenW (lpString="Dhcp") returned 4 [0055.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.900] lstrlenW (lpString="Dnscache") returned 8 [0055.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.900] lstrlenW (lpString="DPS") returned 3 [0055.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.901] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.901] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.901] lstrlenW (lpString="eventlog") returned 8 [0055.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.901] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.901] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.901] lstrlenW (lpString="EventSystem") returned 11 [0055.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.901] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.901] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.901] lstrlenW (lpString="gpsvc") returned 5 [0055.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.901] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.901] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.901] lstrlenW (lpString="iphlpsvc") returned 8 [0055.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.901] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.901] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.901] lstrlenW (lpString="LanmanServer") returned 12 [0055.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.902] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.902] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.902] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.902] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.902] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.902] lstrlenW (lpString="lmhosts") returned 7 [0055.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.902] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.902] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.902] lstrlenW (lpString="MMCSS") returned 5 [0055.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.902] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.902] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.902] lstrlenW (lpString="MpsSvc") returned 6 [0055.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.902] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.902] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.903] lstrlenW (lpString="Netman") returned 6 [0055.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.903] lstrlenW (lpString="netprofm") returned 8 [0055.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.903] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.903] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.903] lstrlenW (lpString="NlaSvc") returned 6 [0055.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.903] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.903] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.903] lstrlenW (lpString="nsi") returned 3 [0055.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.903] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.903] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.903] lstrlenW (lpString="PcaSvc") returned 6 [0055.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.903] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.904] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.904] lstrlenW (lpString="PlugPlay") returned 8 [0055.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.904] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.904] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.904] lstrlenW (lpString="Power") returned 5 [0055.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.904] lstrlenW (lpString="ProfSvc") returned 7 [0055.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.904] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.904] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.904] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.904] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.904] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.904] lstrlenW (lpString="RpcSs") returned 5 [0055.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.905] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.905] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.905] lstrlenW (lpString="SamSs") returned 5 [0055.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.905] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.905] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.905] lstrlenW (lpString="Schedule") returned 8 [0055.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.905] lstrlenW (lpString="SENS") returned 4 [0055.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.905] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.905] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.905] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.905] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.905] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.905] lstrlenW (lpString="Spooler") returned 7 [0055.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.906] lstrlenW (lpString="SysMain") returned 7 [0055.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.906] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.906] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.906] lstrlenW (lpString="Themes") returned 6 [0055.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.906] lstrlenW (lpString="TrkWks") returned 6 [0055.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.906] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.906] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.906] lstrlenW (lpString="UxSms") returned 5 [0055.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.906] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.906] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.906] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.907] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.907] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.907] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.907] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.907] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.907] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.907] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.907] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.907] lstrlenW (lpString="Winmgmt") returned 7 [0055.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.907] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.907] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.907] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.907] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f6d0a8 | out: hHeap=0x5e0000) returned 1 [0055.908] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0055.920] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.922] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.923] lstrlenW (lpString="System") returned 6 [0055.923] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.923] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.923] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.924] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.924] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.924] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.925] lstrlenW (lpString="smss.exe") returned 8 [0055.925] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.925] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.925] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.925] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.925] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.925] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.925] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.925] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.926] lstrlenW (lpString="csrss.exe") returned 9 [0055.926] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.926] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.926] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.926] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.926] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.926] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.926] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.926] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.927] lstrlenW (lpString="wininit.exe") returned 11 [0055.927] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.927] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.927] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.927] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0055.927] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0055.927] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0055.927] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0055.927] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.928] lstrlenW (lpString="csrss.exe") returned 9 [0055.928] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.928] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.928] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.928] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.928] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.928] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.928] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.929] lstrlenW (lpString="winlogon.exe") returned 12 [0055.929] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.930] lstrlenW (lpString="services.exe") returned 12 [0055.930] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.931] lstrlenW (lpString="lsass.exe") returned 9 [0055.931] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.932] lstrlenW (lpString="lsm.exe") returned 7 [0055.932] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.932] lstrlenW (lpString="svchost.exe") returned 11 [0055.933] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.933] lstrlenW (lpString="svchost.exe") returned 11 [0055.933] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.934] lstrlenW (lpString="svchost.exe") returned 11 [0055.934] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.935] lstrlenW (lpString="svchost.exe") returned 11 [0055.935] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.936] lstrlenW (lpString="svchost.exe") returned 11 [0055.936] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.937] lstrlenW (lpString="audiodg.exe") returned 11 [0055.937] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.937] lstrlenW (lpString="svchost.exe") returned 11 [0055.938] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.942] lstrlenW (lpString="svchost.exe") returned 11 [0055.942] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.032] lstrlenW (lpString="dwm.exe") returned 7 [0056.032] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.033] lstrlenW (lpString="explorer.exe") returned 12 [0056.033] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.034] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.034] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.035] lstrlenW (lpString="taskhost.exe") returned 12 [0056.035] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.036] lstrlenW (lpString="svchost.exe") returned 11 [0056.036] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.036] lstrlenW (lpString="taskeng.exe") returned 11 [0056.036] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.039] lstrlenW (lpString="taskhost.exe") returned 12 [0056.039] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0056.039] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0056.040] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0056.040] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0056.040] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0056.041] lstrlenW (lpString="rides.exe") returned 9 [0056.041] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0056.042] lstrlenW (lpString="logos.exe") returned 9 [0056.042] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0056.043] lstrlenW (lpString="blades.exe") returned 10 [0056.043] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0056.044] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0056.044] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0056.045] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0056.045] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0056.046] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0056.046] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0056.046] lstrlenW (lpString="zealand.exe") returned 11 [0056.046] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0056.047] lstrlenW (lpString="donate.exe") returned 10 [0056.047] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0056.048] lstrlenW (lpString="release_county.exe") returned 18 [0056.048] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0056.049] lstrlenW (lpString="merit.exe") returned 9 [0056.049] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0056.049] lstrlenW (lpString="controversial.exe") returned 17 [0056.049] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0056.050] lstrlenW (lpString="likelihood.exe") returned 14 [0056.050] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0056.051] lstrlenW (lpString="rugby bean.exe") returned 14 [0056.051] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0056.052] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0056.052] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0056.052] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0056.053] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0056.053] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0056.054] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0056.095] lstrlenW (lpString="frankfurt.exe") returned 13 [0056.095] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0056.096] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0056.096] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0056.097] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0056.097] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.097] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.098] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0056.098] lstrlenW (lpString="dllhost.exe") returned 11 [0056.098] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0056.099] lstrlenW (lpString="dllhost.exe") returned 11 [0056.099] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0056.100] lstrlenW (lpString="svhost.exe") returned 10 [0056.100] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.101] lstrlenW (lpString="cmd.exe") returned 7 [0056.101] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.102] lstrlenW (lpString="conhost.exe") returned 11 [0056.102] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.103] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.103] Process32NextW (in: hSnapshot=0x1d4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0056.104] CloseHandle (hObject=0x1d4) returned 1 [0056.104] Sleep (dwMilliseconds=0x1f4) [0056.852] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6604b8 [0056.853] EnumServicesStatusExW (in: hSCManager=0x6604b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0056.853] GetLastError () returned 0xea [0056.853] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x3f64098 [0056.853] EnumServicesStatusExW (in: hSCManager=0x6604b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f64098, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f64098, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0056.854] CloseServiceHandle (hSCObject=0x6604b8) returned 1 [0056.854] lstrlenW (lpString="Appinfo") returned 7 [0056.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.854] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.854] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.854] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.854] lstrlenW (lpString="AudioSrv") returned 8 [0056.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.854] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.854] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.854] lstrlenW (lpString="BFE") returned 3 [0056.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.854] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.855] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.860] lstrlenW (lpString="CryptSvc") returned 8 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.860] lstrlenW (lpString="CscService") returned 10 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.860] lstrlenW (lpString="DcomLaunch") returned 10 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.860] lstrlenW (lpString="Dhcp") returned 4 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.860] lstrlenW (lpString="Dnscache") returned 8 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.861] lstrlenW (lpString="DPS") returned 3 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.861] lstrlenW (lpString="eventlog") returned 8 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.861] lstrlenW (lpString="EventSystem") returned 11 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.861] lstrlenW (lpString="gpsvc") returned 5 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.861] lstrlenW (lpString="iphlpsvc") returned 8 [0056.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.862] lstrlenW (lpString="LanmanServer") returned 12 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.862] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.862] lstrlenW (lpString="lmhosts") returned 7 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.862] lstrlenW (lpString="MMCSS") returned 5 [0056.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.862] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.862] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.862] lstrlenW (lpString="MpsSvc") returned 6 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.863] lstrlenW (lpString="Netman") returned 6 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.863] lstrlenW (lpString="netprofm") returned 8 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.863] lstrlenW (lpString="NlaSvc") returned 6 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.863] lstrlenW (lpString="nsi") returned 3 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.863] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.863] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.864] lstrlenW (lpString="PcaSvc") returned 6 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.864] lstrlenW (lpString="PlugPlay") returned 8 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.864] lstrlenW (lpString="Power") returned 5 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.864] lstrlenW (lpString="ProfSvc") returned 7 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.864] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.865] lstrlenW (lpString="RpcSs") returned 5 [0056.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.865] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.865] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.865] lstrlenW (lpString="SamSs") returned 5 [0056.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.865] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.865] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.865] lstrlenW (lpString="Schedule") returned 8 [0056.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.865] lstrlenW (lpString="SENS") returned 4 [0056.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.865] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.865] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.865] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.865] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.866] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.866] lstrlenW (lpString="Spooler") returned 7 [0056.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.866] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.866] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.866] lstrlenW (lpString="SysMain") returned 7 [0056.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.866] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.866] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.866] lstrlenW (lpString="Themes") returned 6 [0056.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.866] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.866] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.866] lstrlenW (lpString="TrkWks") returned 6 [0056.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.866] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.866] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.866] lstrlenW (lpString="UxSms") returned 5 [0056.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.867] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.867] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.867] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.867] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.867] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.867] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.867] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.867] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.867] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.867] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.867] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.867] lstrlenW (lpString="Winmgmt") returned 7 [0056.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.867] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.868] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.868] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.868] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f64098 | out: hHeap=0x5e0000) returned 1 [0056.868] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0056.870] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.871] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.872] lstrlenW (lpString="System") returned 6 [0056.872] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.872] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.872] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.872] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.872] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.872] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.872] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.872] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.878] lstrlenW (lpString="smss.exe") returned 8 [0056.878] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.878] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.878] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.878] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.878] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.878] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.878] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.879] lstrlenW (lpString="csrss.exe") returned 9 [0056.879] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.879] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.879] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.879] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.879] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.879] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.879] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.879] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.880] lstrlenW (lpString="wininit.exe") returned 11 [0056.880] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.880] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.880] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.880] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0056.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0056.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0056.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0056.880] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.881] lstrlenW (lpString="csrss.exe") returned 9 [0056.881] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.881] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.881] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.881] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.882] lstrlenW (lpString="winlogon.exe") returned 12 [0056.882] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.883] lstrlenW (lpString="services.exe") returned 12 [0056.883] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.883] lstrlenW (lpString="lsass.exe") returned 9 [0056.884] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.884] lstrlenW (lpString="lsm.exe") returned 7 [0056.884] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.885] lstrlenW (lpString="svchost.exe") returned 11 [0056.885] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.886] lstrlenW (lpString="svchost.exe") returned 11 [0056.886] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.887] lstrlenW (lpString="svchost.exe") returned 11 [0056.887] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.887] lstrlenW (lpString="svchost.exe") returned 11 [0056.888] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.888] lstrlenW (lpString="svchost.exe") returned 11 [0056.888] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.889] lstrlenW (lpString="audiodg.exe") returned 11 [0056.889] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.890] lstrlenW (lpString="svchost.exe") returned 11 [0056.890] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.891] lstrlenW (lpString="svchost.exe") returned 11 [0056.891] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.892] lstrlenW (lpString="dwm.exe") returned 7 [0056.892] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.892] lstrlenW (lpString="explorer.exe") returned 12 [0056.893] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.893] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.893] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.894] lstrlenW (lpString="taskhost.exe") returned 12 [0056.894] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.895] lstrlenW (lpString="svchost.exe") returned 11 [0056.895] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.896] lstrlenW (lpString="taskeng.exe") returned 11 [0056.896] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.896] lstrlenW (lpString="taskhost.exe") returned 12 [0056.897] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0056.897] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0056.897] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0056.898] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0056.898] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0056.899] lstrlenW (lpString="rides.exe") returned 9 [0056.899] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0056.900] lstrlenW (lpString="logos.exe") returned 9 [0056.900] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0056.900] lstrlenW (lpString="blades.exe") returned 10 [0056.900] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0056.901] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0056.901] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0056.902] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0056.902] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0056.903] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0056.903] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0056.904] lstrlenW (lpString="zealand.exe") returned 11 [0056.904] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0056.905] lstrlenW (lpString="donate.exe") returned 10 [0056.905] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0056.905] lstrlenW (lpString="release_county.exe") returned 18 [0056.905] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0056.906] lstrlenW (lpString="merit.exe") returned 9 [0056.906] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0057.055] lstrlenW (lpString="controversial.exe") returned 17 [0057.056] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0057.056] lstrlenW (lpString="likelihood.exe") returned 14 [0057.056] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0057.057] lstrlenW (lpString="rugby bean.exe") returned 14 [0057.057] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0057.058] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0057.058] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0057.058] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0057.058] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0057.059] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0057.059] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0057.059] lstrlenW (lpString="frankfurt.exe") returned 13 [0057.060] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0057.060] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0057.060] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0057.061] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0057.061] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.061] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.061] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0057.062] lstrlenW (lpString="svhost.exe") returned 10 [0057.062] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.063] lstrlenW (lpString="cmd.exe") returned 7 [0057.063] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.064] lstrlenW (lpString="conhost.exe") returned 11 [0057.064] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.064] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.064] Process32NextW (in: hSnapshot=0x1c8, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0057.065] CloseHandle (hObject=0x1c8) returned 1 [0057.065] Sleep (dwMilliseconds=0x1f4) [0058.331] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6604b8 [0058.331] EnumServicesStatusExW (in: hSCManager=0x6604b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0058.332] GetLastError () returned 0xea [0058.332] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x3f28080 [0058.332] EnumServicesStatusExW (in: hSCManager=0x6604b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f28080, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f28080, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0058.333] CloseServiceHandle (hSCObject=0x6604b8) returned 1 [0058.333] lstrlenW (lpString="Appinfo") returned 7 [0058.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.333] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.333] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.333] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.333] lstrlenW (lpString="AudioSrv") returned 8 [0058.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0058.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0058.333] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0058.333] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0058.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0058.334] lstrlenW (lpString="BFE") returned 3 [0058.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.334] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.334] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.334] lstrlenW (lpString="CryptSvc") returned 8 [0058.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.334] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.334] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.334] lstrlenW (lpString="CscService") returned 10 [0058.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0058.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0058.334] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0058.334] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0058.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0058.334] lstrlenW (lpString="DcomLaunch") returned 10 [0058.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.334] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.334] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.334] lstrlenW (lpString="Dhcp") returned 4 [0058.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.335] lstrlenW (lpString="Dnscache") returned 8 [0058.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.335] lstrlenW (lpString="DPS") returned 3 [0058.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.335] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.335] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.335] lstrlenW (lpString="eventlog") returned 8 [0058.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0058.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0058.335] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0058.335] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0058.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0058.335] lstrlenW (lpString="EventSystem") returned 11 [0058.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.335] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.335] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.335] lstrlenW (lpString="gpsvc") returned 5 [0058.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.335] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.336] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.336] lstrlenW (lpString="iphlpsvc") returned 8 [0058.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.336] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.336] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.336] lstrlenW (lpString="LanmanServer") returned 12 [0058.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.336] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.336] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.336] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.336] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.336] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.336] lstrlenW (lpString="lmhosts") returned 7 [0058.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.336] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.336] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.336] lstrlenW (lpString="MMCSS") returned 5 [0058.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0058.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0058.337] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0058.337] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0058.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0058.337] lstrlenW (lpString="MpsSvc") returned 6 [0058.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.337] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.337] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.337] lstrlenW (lpString="Netman") returned 6 [0058.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0058.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0058.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0058.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0058.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0058.337] lstrlenW (lpString="netprofm") returned 8 [0058.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.337] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.337] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.337] lstrlenW (lpString="NlaSvc") returned 6 [0058.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.337] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.337] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.337] lstrlenW (lpString="nsi") returned 3 [0058.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.338] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.338] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.338] lstrlenW (lpString="PcaSvc") returned 6 [0058.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.338] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.338] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.338] lstrlenW (lpString="PlugPlay") returned 8 [0058.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.338] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.338] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.338] lstrlenW (lpString="Power") returned 5 [0058.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.338] lstrlenW (lpString="ProfSvc") returned 7 [0058.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.338] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.338] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.338] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.339] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.339] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.339] lstrlenW (lpString="RpcSs") returned 5 [0058.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.339] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.339] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.339] lstrlenW (lpString="SamSs") returned 5 [0058.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.339] lstrlenW (lpString="Schedule") returned 8 [0058.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.339] lstrlenW (lpString="SENS") returned 4 [0058.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.340] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.340] lstrlenW (lpString="Spooler") returned 7 [0058.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.340] lstrlenW (lpString="SysMain") returned 7 [0058.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0058.340] lstrlenW (lpString="Themes") returned 6 [0058.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0058.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0058.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0058.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0058.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0058.340] lstrlenW (lpString="TrkWks") returned 6 [0058.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0058.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0058.340] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0058.341] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0058.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0058.341] lstrlenW (lpString="UxSms") returned 5 [0058.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0058.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0058.341] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0058.341] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0058.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0058.341] lstrlenW (lpString="WdiServiceHost") returned 14 [0058.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.341] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0058.341] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0058.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0058.341] lstrlenW (lpString="WdiSystemHost") returned 13 [0058.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.341] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0058.341] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0058.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0058.341] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0058.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.341] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0058.341] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0058.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0058.342] lstrlenW (lpString="Winmgmt") returned 7 [0058.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0058.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0058.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0058.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0058.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0058.342] lstrlenW (lpString="WPDBusEnum") returned 10 [0058.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.342] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0058.342] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0058.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0058.342] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f28080 | out: hHeap=0x5e0000) returned 1 [0058.342] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0058.345] Process32FirstW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.345] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.346] lstrlenW (lpString="System") returned 6 [0058.346] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0058.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0058.346] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0058.346] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0058.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0058.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0058.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0058.346] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.347] lstrlenW (lpString="smss.exe") returned 8 [0058.347] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0058.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0058.347] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0058.347] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0058.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0058.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0058.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0058.347] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.348] lstrlenW (lpString="csrss.exe") returned 9 [0058.348] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0058.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0058.348] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0058.348] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0058.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0058.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0058.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0058.348] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.349] lstrlenW (lpString="wininit.exe") returned 11 [0058.349] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0058.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0058.349] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0058.349] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0058.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0058.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0058.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0058.349] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.350] lstrlenW (lpString="csrss.exe") returned 9 [0058.350] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0058.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0058.350] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0058.350] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0058.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0058.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0058.350] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.351] lstrlenW (lpString="winlogon.exe") returned 12 [0058.351] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.352] lstrlenW (lpString="services.exe") returned 12 [0058.352] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.353] lstrlenW (lpString="lsass.exe") returned 9 [0058.353] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.354] lstrlenW (lpString="lsm.exe") returned 7 [0058.354] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.354] lstrlenW (lpString="svchost.exe") returned 11 [0058.354] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.355] lstrlenW (lpString="svchost.exe") returned 11 [0058.355] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.356] lstrlenW (lpString="svchost.exe") returned 11 [0058.356] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.357] lstrlenW (lpString="svchost.exe") returned 11 [0058.357] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.358] lstrlenW (lpString="svchost.exe") returned 11 [0058.358] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.358] lstrlenW (lpString="audiodg.exe") returned 11 [0058.359] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.359] lstrlenW (lpString="svchost.exe") returned 11 [0058.359] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.360] lstrlenW (lpString="svchost.exe") returned 11 [0058.360] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.361] lstrlenW (lpString="dwm.exe") returned 7 [0058.361] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.362] lstrlenW (lpString="explorer.exe") returned 12 [0058.362] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.363] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.363] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.363] lstrlenW (lpString="taskhost.exe") returned 12 [0058.363] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.364] lstrlenW (lpString="svchost.exe") returned 11 [0058.364] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0058.365] lstrlenW (lpString="taskeng.exe") returned 11 [0058.365] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.366] lstrlenW (lpString="taskhost.exe") returned 12 [0058.366] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0058.367] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0058.367] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0058.368] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0058.368] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0058.368] lstrlenW (lpString="rides.exe") returned 9 [0058.368] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0058.369] lstrlenW (lpString="logos.exe") returned 9 [0058.369] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0058.370] lstrlenW (lpString="blades.exe") returned 10 [0058.370] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0058.371] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0058.371] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0058.372] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0058.372] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0058.373] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0058.438] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0058.439] lstrlenW (lpString="zealand.exe") returned 11 [0058.439] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0058.440] lstrlenW (lpString="donate.exe") returned 10 [0058.440] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0058.440] lstrlenW (lpString="release_county.exe") returned 18 [0058.441] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0058.441] lstrlenW (lpString="merit.exe") returned 9 [0058.441] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0058.442] lstrlenW (lpString="controversial.exe") returned 17 [0058.442] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0058.443] lstrlenW (lpString="likelihood.exe") returned 14 [0058.443] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0058.444] lstrlenW (lpString="rugby bean.exe") returned 14 [0058.444] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0058.444] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0058.445] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0058.446] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0058.446] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0058.446] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0058.447] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0058.448] lstrlenW (lpString="frankfurt.exe") returned 13 [0058.448] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0058.449] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0058.449] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0058.450] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0058.450] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.451] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.451] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0058.452] lstrlenW (lpString="svhost.exe") returned 10 [0058.452] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.453] lstrlenW (lpString="cmd.exe") returned 7 [0058.453] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.454] lstrlenW (lpString="conhost.exe") returned 11 [0058.454] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.454] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.455] Process32NextW (in: hSnapshot=0x208, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0058.455] CloseHandle (hObject=0x208) returned 1 [0058.455] Sleep (dwMilliseconds=0x1f4) [0059.013] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6604b8 [0059.013] EnumServicesStatusExW (in: hSCManager=0x6604b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0059.013] GetLastError () returned 0xea [0059.013] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x396da00 [0059.013] EnumServicesStatusExW (in: hSCManager=0x6604b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x396da00, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x396da00, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0059.014] CloseServiceHandle (hSCObject=0x6604b8) returned 1 [0059.014] lstrlenW (lpString="Appinfo") returned 7 [0059.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.014] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.015] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.015] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.015] lstrlenW (lpString="AudioSrv") returned 8 [0059.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.015] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.015] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.015] lstrlenW (lpString="BFE") returned 3 [0059.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.015] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.015] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.015] lstrlenW (lpString="CryptSvc") returned 8 [0059.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.015] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.015] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.015] lstrlenW (lpString="CscService") returned 10 [0059.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.015] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.015] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.016] lstrlenW (lpString="DcomLaunch") returned 10 [0059.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.016] lstrlenW (lpString="Dhcp") returned 4 [0059.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.016] lstrlenW (lpString="Dnscache") returned 8 [0059.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.016] lstrlenW (lpString="DPS") returned 3 [0059.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.016] lstrlenW (lpString="eventlog") returned 8 [0059.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.016] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.016] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.017] lstrlenW (lpString="EventSystem") returned 11 [0059.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.017] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.017] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.017] lstrlenW (lpString="gpsvc") returned 5 [0059.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.017] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.017] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.017] lstrlenW (lpString="iphlpsvc") returned 8 [0059.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.017] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.017] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.017] lstrlenW (lpString="LanmanServer") returned 12 [0059.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.017] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.017] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.017] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.018] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.018] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.018] lstrlenW (lpString="lmhosts") returned 7 [0059.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.018] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.018] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.018] lstrlenW (lpString="MMCSS") returned 5 [0059.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.018] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.018] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.018] lstrlenW (lpString="MpsSvc") returned 6 [0059.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.018] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.018] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.018] lstrlenW (lpString="Netman") returned 6 [0059.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.019] lstrlenW (lpString="netprofm") returned 8 [0059.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.019] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.019] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.019] lstrlenW (lpString="NlaSvc") returned 6 [0059.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.019] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.019] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.019] lstrlenW (lpString="nsi") returned 3 [0059.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.019] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.019] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.019] lstrlenW (lpString="PcaSvc") returned 6 [0059.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.019] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.019] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.019] lstrlenW (lpString="PlugPlay") returned 8 [0059.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.019] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.019] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.019] lstrlenW (lpString="Power") returned 5 [0059.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.020] lstrlenW (lpString="ProfSvc") returned 7 [0059.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.020] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.020] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.020] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.020] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.020] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.020] lstrlenW (lpString="RpcSs") returned 5 [0059.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.020] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.020] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.020] lstrlenW (lpString="SamSs") returned 5 [0059.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.020] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.020] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.021] lstrlenW (lpString="Schedule") returned 8 [0059.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.021] lstrlenW (lpString="SENS") returned 4 [0059.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.021] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.021] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.021] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.021] lstrlenW (lpString="Spooler") returned 7 [0059.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.021] lstrlenW (lpString="SysMain") returned 7 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.022] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.022] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.022] lstrlenW (lpString="Themes") returned 6 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.022] lstrlenW (lpString="TrkWks") returned 6 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.022] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.022] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.022] lstrlenW (lpString="UxSms") returned 5 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.022] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.022] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.022] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.022] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.022] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.022] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.023] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.023] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.023] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.023] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.023] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.023] lstrlenW (lpString="Winmgmt") returned 7 [0059.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.023] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.023] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.023] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.023] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.023] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.023] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x396da00 | out: hHeap=0x5e0000) returned 1 [0059.023] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x170 [0059.025] Process32FirstW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.026] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.027] lstrlenW (lpString="System") returned 6 [0059.027] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.027] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.027] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.027] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.027] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.027] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.028] lstrlenW (lpString="smss.exe") returned 8 [0059.028] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.028] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.028] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.028] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.028] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.028] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.028] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.028] lstrlenW (lpString="csrss.exe") returned 9 [0059.028] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.029] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.029] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.029] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.029] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.029] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.029] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.029] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.029] lstrlenW (lpString="wininit.exe") returned 11 [0059.029] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.029] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.029] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.029] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0059.030] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0059.030] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0059.030] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0059.030] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.030] lstrlenW (lpString="csrss.exe") returned 9 [0059.030] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.030] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.030] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.030] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.030] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.030] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.031] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.031] lstrlenW (lpString="winlogon.exe") returned 12 [0059.031] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.032] lstrlenW (lpString="services.exe") returned 12 [0059.032] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.032] lstrlenW (lpString="lsass.exe") returned 9 [0059.032] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.033] lstrlenW (lpString="lsm.exe") returned 7 [0059.033] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.034] lstrlenW (lpString="svchost.exe") returned 11 [0059.034] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.034] lstrlenW (lpString="svchost.exe") returned 11 [0059.034] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.035] lstrlenW (lpString="svchost.exe") returned 11 [0059.035] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.036] lstrlenW (lpString="svchost.exe") returned 11 [0059.036] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.036] lstrlenW (lpString="svchost.exe") returned 11 [0059.036] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.037] lstrlenW (lpString="audiodg.exe") returned 11 [0059.037] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.038] lstrlenW (lpString="svchost.exe") returned 11 [0059.038] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.038] lstrlenW (lpString="svchost.exe") returned 11 [0059.038] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.039] lstrlenW (lpString="dwm.exe") returned 7 [0059.039] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.040] lstrlenW (lpString="explorer.exe") returned 12 [0059.040] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.040] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.040] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.041] lstrlenW (lpString="taskhost.exe") returned 12 [0059.041] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.042] lstrlenW (lpString="svchost.exe") returned 11 [0059.042] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.042] lstrlenW (lpString="taskeng.exe") returned 11 [0059.042] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.043] lstrlenW (lpString="taskhost.exe") returned 12 [0059.043] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0059.044] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0059.044] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0059.044] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0059.044] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0059.045] lstrlenW (lpString="rides.exe") returned 9 [0059.045] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0059.046] lstrlenW (lpString="logos.exe") returned 9 [0059.046] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0059.046] lstrlenW (lpString="blades.exe") returned 10 [0059.046] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0059.047] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0059.047] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0059.048] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0059.048] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0059.048] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0059.048] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0059.049] lstrlenW (lpString="zealand.exe") returned 11 [0059.049] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0059.050] lstrlenW (lpString="donate.exe") returned 10 [0059.050] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0059.050] lstrlenW (lpString="release_county.exe") returned 18 [0059.050] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0059.051] lstrlenW (lpString="merit.exe") returned 9 [0059.051] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0059.052] lstrlenW (lpString="controversial.exe") returned 17 [0059.052] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0059.052] lstrlenW (lpString="likelihood.exe") returned 14 [0059.052] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0059.053] lstrlenW (lpString="rugby bean.exe") returned 14 [0059.053] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0059.055] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0059.055] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0059.056] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0059.056] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0059.056] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0059.056] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0059.057] lstrlenW (lpString="frankfurt.exe") returned 13 [0059.057] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0059.057] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0059.057] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0059.058] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0059.058] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.059] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.059] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0059.059] lstrlenW (lpString="svhost.exe") returned 10 [0059.060] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.062] lstrlenW (lpString="cmd.exe") returned 7 [0059.063] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.063] lstrlenW (lpString="conhost.exe") returned 11 [0059.063] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.064] lstrlenW (lpString="vssadmin.exe") returned 12 [0059.064] Process32NextW (in: hSnapshot=0x170, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0059.065] CloseHandle (hObject=0x170) returned 1 [0059.065] Sleep (dwMilliseconds=0x1f4) [0059.731] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660530 [0059.731] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0059.732] GetLastError () returned 0xea [0059.732] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x11e4) returned 0x3f2a090 [0059.732] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2a090, cbBufSize=0x11e4, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2a090, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0059.732] CloseServiceHandle (hSCObject=0x660530) returned 1 [0059.733] lstrlenW (lpString="Appinfo") returned 7 [0059.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.733] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.733] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.733] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.733] lstrlenW (lpString="AudioSrv") returned 8 [0059.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.733] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.733] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.733] lstrlenW (lpString="BFE") returned 3 [0059.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.733] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.733] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.733] lstrlenW (lpString="CryptSvc") returned 8 [0059.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.733] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.734] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.734] lstrlenW (lpString="CscService") returned 10 [0059.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.734] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.734] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.734] lstrlenW (lpString="DcomLaunch") returned 10 [0059.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.734] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.734] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.734] lstrlenW (lpString="Dhcp") returned 4 [0059.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.734] lstrlenW (lpString="Dnscache") returned 8 [0059.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.735] lstrlenW (lpString="DPS") returned 3 [0059.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.735] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.735] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.735] lstrlenW (lpString="eventlog") returned 8 [0059.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.735] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.735] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.735] lstrlenW (lpString="EventSystem") returned 11 [0059.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.736] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.736] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.736] lstrlenW (lpString="gpsvc") returned 5 [0059.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.736] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.736] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.824] lstrlenW (lpString="iphlpsvc") returned 8 [0059.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.824] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.824] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.824] lstrlenW (lpString="LanmanServer") returned 12 [0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.825] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.825] lstrlenW (lpString="lmhosts") returned 7 [0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.825] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.825] lstrlenW (lpString="MMCSS") returned 5 [0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.825] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.825] lstrlenW (lpString="MpsSvc") returned 6 [0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.826] lstrlenW (lpString="Netman") returned 6 [0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.826] lstrlenW (lpString="netprofm") returned 8 [0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.826] lstrlenW (lpString="NlaSvc") returned 6 [0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.826] lstrlenW (lpString="nsi") returned 3 [0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.826] lstrlenW (lpString="PcaSvc") returned 6 [0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.827] lstrlenW (lpString="PlugPlay") returned 8 [0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.827] lstrlenW (lpString="Power") returned 5 [0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.827] lstrlenW (lpString="ProfSvc") returned 7 [0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.827] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.827] lstrlenW (lpString="RpcSs") returned 5 [0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.828] lstrlenW (lpString="SamSs") returned 5 [0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.828] lstrlenW (lpString="Schedule") returned 8 [0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.828] lstrlenW (lpString="SENS") returned 4 [0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.828] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.829] lstrlenW (lpString="Spooler") returned 7 [0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.829] lstrlenW (lpString="SysMain") returned 7 [0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.829] lstrlenW (lpString="Themes") returned 6 [0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.829] lstrlenW (lpString="TrkWks") returned 6 [0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.829] lstrlenW (lpString="UxSms") returned 5 [0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.830] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.830] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.830] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.830] lstrlenW (lpString="Winmgmt") returned 7 [0059.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.831] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.833] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f2a090 | out: hHeap=0x5e0000) returned 1 [0059.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0059.835] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.835] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.836] lstrlenW (lpString="System") returned 6 [0059.836] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.836] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.836] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.836] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.837] lstrlenW (lpString="smss.exe") returned 8 [0059.837] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.837] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.837] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.837] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.837] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.837] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.837] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.837] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.838] lstrlenW (lpString="csrss.exe") returned 9 [0059.838] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.838] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.838] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.838] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.838] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.838] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.838] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.838] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.839] lstrlenW (lpString="wininit.exe") returned 11 [0059.839] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.839] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.839] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0059.839] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0059.839] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0059.839] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0059.839] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.840] lstrlenW (lpString="csrss.exe") returned 9 [0059.840] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.840] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.840] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.840] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.840] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.840] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.840] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.841] lstrlenW (lpString="winlogon.exe") returned 12 [0059.841] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.841] lstrlenW (lpString="services.exe") returned 12 [0059.842] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.842] lstrlenW (lpString="lsass.exe") returned 9 [0059.842] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.843] lstrlenW (lpString="lsm.exe") returned 7 [0059.843] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.843] lstrlenW (lpString="svchost.exe") returned 11 [0059.843] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.844] lstrlenW (lpString="svchost.exe") returned 11 [0059.844] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.845] lstrlenW (lpString="svchost.exe") returned 11 [0059.845] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.845] lstrlenW (lpString="svchost.exe") returned 11 [0059.845] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.846] lstrlenW (lpString="svchost.exe") returned 11 [0059.846] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.847] lstrlenW (lpString="audiodg.exe") returned 11 [0059.847] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.847] lstrlenW (lpString="svchost.exe") returned 11 [0059.847] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.849] lstrlenW (lpString="svchost.exe") returned 11 [0059.849] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.850] lstrlenW (lpString="dwm.exe") returned 7 [0059.850] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.850] lstrlenW (lpString="explorer.exe") returned 12 [0059.850] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.851] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.851] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.852] lstrlenW (lpString="taskhost.exe") returned 12 [0059.852] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.852] lstrlenW (lpString="svchost.exe") returned 11 [0059.852] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.853] lstrlenW (lpString="taskeng.exe") returned 11 [0059.853] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.854] lstrlenW (lpString="taskhost.exe") returned 12 [0059.854] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0059.854] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0059.854] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0060.059] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0060.059] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0060.060] lstrlenW (lpString="rides.exe") returned 9 [0060.060] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0060.060] lstrlenW (lpString="logos.exe") returned 9 [0060.060] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0060.061] lstrlenW (lpString="blades.exe") returned 10 [0060.061] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0060.062] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0060.062] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0060.062] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0060.062] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0060.063] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0060.063] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0060.063] lstrlenW (lpString="zealand.exe") returned 11 [0060.064] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0060.064] lstrlenW (lpString="donate.exe") returned 10 [0060.064] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0060.065] lstrlenW (lpString="release_county.exe") returned 18 [0060.065] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0060.065] lstrlenW (lpString="merit.exe") returned 9 [0060.065] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0060.066] lstrlenW (lpString="controversial.exe") returned 17 [0060.066] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0060.067] lstrlenW (lpString="likelihood.exe") returned 14 [0060.067] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0060.067] lstrlenW (lpString="rugby bean.exe") returned 14 [0060.067] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0060.068] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0060.068] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0060.069] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0060.069] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0060.069] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0060.069] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0060.070] lstrlenW (lpString="frankfurt.exe") returned 13 [0060.070] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0060.071] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0060.071] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0060.071] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0060.071] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.072] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.072] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0060.072] lstrlenW (lpString="svhost.exe") returned 10 [0060.072] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.073] lstrlenW (lpString="cmd.exe") returned 7 [0060.073] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.074] lstrlenW (lpString="conhost.exe") returned 11 [0060.074] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.074] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.074] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0060.076] CloseHandle (hObject=0x1a4) returned 1 [0060.076] Sleep (dwMilliseconds=0x1f4) [0060.635] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660530 [0060.635] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0060.635] GetLastError () returned 0xea [0060.635] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x123e) returned 0x3f2a090 [0060.635] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2a090, cbBufSize=0x123e, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2a090, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0060.636] CloseServiceHandle (hSCObject=0x660530) returned 1 [0060.636] lstrlenW (lpString="Appinfo") returned 7 [0060.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.636] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.637] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.637] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.637] lstrlenW (lpString="AudioSrv") returned 8 [0060.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.637] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.637] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.637] lstrlenW (lpString="BFE") returned 3 [0060.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.637] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.637] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.637] lstrlenW (lpString="CryptSvc") returned 8 [0060.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.637] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.637] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.637] lstrlenW (lpString="CscService") returned 10 [0060.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.637] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.637] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.637] lstrlenW (lpString="DcomLaunch") returned 10 [0060.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.638] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.638] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.638] lstrlenW (lpString="Dhcp") returned 4 [0060.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.638] lstrlenW (lpString="Dnscache") returned 8 [0060.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.638] lstrlenW (lpString="DPS") returned 3 [0060.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.638] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.638] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.638] lstrlenW (lpString="eventlog") returned 8 [0060.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.638] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.638] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.639] lstrlenW (lpString="EventSystem") returned 11 [0060.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.639] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.639] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.639] lstrlenW (lpString="gpsvc") returned 5 [0060.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.639] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.639] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.639] lstrlenW (lpString="iphlpsvc") returned 8 [0060.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.639] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.639] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.639] lstrlenW (lpString="LanmanServer") returned 12 [0060.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.639] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.639] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.639] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.639] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.640] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.640] lstrlenW (lpString="lmhosts") returned 7 [0060.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.640] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.640] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.640] lstrlenW (lpString="MMCSS") returned 5 [0060.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.640] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.640] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.640] lstrlenW (lpString="MpsSvc") returned 6 [0060.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.640] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.640] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.640] lstrlenW (lpString="Netman") returned 6 [0060.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.640] lstrlenW (lpString="netprofm") returned 8 [0060.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.641] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.641] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.641] lstrlenW (lpString="NlaSvc") returned 6 [0060.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.641] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.641] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.641] lstrlenW (lpString="nsi") returned 3 [0060.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.641] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.641] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.641] lstrlenW (lpString="PcaSvc") returned 6 [0060.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.641] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.641] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.641] lstrlenW (lpString="PlugPlay") returned 8 [0060.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.641] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.641] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.642] lstrlenW (lpString="Power") returned 5 [0060.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.642] lstrlenW (lpString="ProfSvc") returned 7 [0060.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.642] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.642] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.642] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.642] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.642] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.642] lstrlenW (lpString="RpcSs") returned 5 [0060.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.642] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.642] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.642] lstrlenW (lpString="SamSs") returned 5 [0060.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.643] lstrlenW (lpString="Schedule") returned 8 [0060.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.643] lstrlenW (lpString="SENS") returned 4 [0060.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.643] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.643] lstrlenW (lpString="Spooler") returned 7 [0060.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.643] lstrlenW (lpString="SysMain") returned 7 [0060.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.644] lstrlenW (lpString="Themes") returned 6 [0060.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.644] lstrlenW (lpString="TrkWks") returned 6 [0060.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.644] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.644] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.644] lstrlenW (lpString="UxSms") returned 5 [0060.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.644] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.644] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.644] lstrlenW (lpString="VSS") returned 3 [0060.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0060.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0060.644] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0060.644] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0060.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0060.645] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.645] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.645] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.645] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.645] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.645] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.645] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.645] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.645] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.645] lstrlenW (lpString="Winmgmt") returned 7 [0060.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.645] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.645] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.646] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.646] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f2a090 | out: hHeap=0x5e0000) returned 1 [0060.646] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184 [0060.648] Process32FirstW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.648] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.649] lstrlenW (lpString="System") returned 6 [0060.649] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.649] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.649] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.649] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.650] lstrlenW (lpString="smss.exe") returned 8 [0060.650] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.650] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.650] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.650] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.651] lstrlenW (lpString="csrss.exe") returned 9 [0060.651] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.651] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.651] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.651] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.651] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.651] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.651] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.652] lstrlenW (lpString="wininit.exe") returned 11 [0060.652] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.652] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.652] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.652] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0060.652] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0060.652] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0060.652] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0060.652] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.653] lstrlenW (lpString="csrss.exe") returned 9 [0060.653] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.653] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.653] lstrlenW (lpString="winlogon.exe") returned 12 [0060.654] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.654] lstrlenW (lpString="services.exe") returned 12 [0060.654] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.655] lstrlenW (lpString="lsass.exe") returned 9 [0060.655] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.656] lstrlenW (lpString="lsm.exe") returned 7 [0060.656] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.656] lstrlenW (lpString="svchost.exe") returned 11 [0060.656] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.657] lstrlenW (lpString="svchost.exe") returned 11 [0060.657] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.658] lstrlenW (lpString="svchost.exe") returned 11 [0060.658] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.659] lstrlenW (lpString="svchost.exe") returned 11 [0060.659] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.659] lstrlenW (lpString="svchost.exe") returned 11 [0060.659] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.663] lstrlenW (lpString="audiodg.exe") returned 11 [0060.663] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.664] lstrlenW (lpString="svchost.exe") returned 11 [0060.664] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.665] lstrlenW (lpString="svchost.exe") returned 11 [0060.666] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.667] lstrlenW (lpString="dwm.exe") returned 7 [0060.667] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.668] lstrlenW (lpString="explorer.exe") returned 12 [0060.668] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.669] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.669] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.669] lstrlenW (lpString="taskhost.exe") returned 12 [0060.669] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.670] lstrlenW (lpString="svchost.exe") returned 11 [0060.670] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.671] lstrlenW (lpString="taskeng.exe") returned 11 [0060.671] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.671] lstrlenW (lpString="taskhost.exe") returned 12 [0060.671] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0060.672] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0060.672] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0060.673] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0060.673] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0060.673] lstrlenW (lpString="rides.exe") returned 9 [0060.673] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0060.674] lstrlenW (lpString="logos.exe") returned 9 [0060.674] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0060.675] lstrlenW (lpString="blades.exe") returned 10 [0060.675] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0060.675] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0060.675] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0060.676] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0060.676] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0060.677] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0060.677] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0060.678] lstrlenW (lpString="zealand.exe") returned 11 [0060.678] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0060.678] lstrlenW (lpString="donate.exe") returned 10 [0060.678] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0060.679] lstrlenW (lpString="release_county.exe") returned 18 [0060.679] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0060.680] lstrlenW (lpString="merit.exe") returned 9 [0060.680] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0060.680] lstrlenW (lpString="controversial.exe") returned 17 [0060.680] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0060.681] lstrlenW (lpString="likelihood.exe") returned 14 [0060.681] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0060.682] lstrlenW (lpString="rugby bean.exe") returned 14 [0060.682] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0060.683] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0060.683] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0060.683] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0060.683] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0060.684] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0060.684] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0060.685] lstrlenW (lpString="frankfurt.exe") returned 13 [0060.685] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0060.686] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0060.686] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0060.686] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0060.686] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.687] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.687] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0060.688] lstrlenW (lpString="svhost.exe") returned 10 [0060.688] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.689] lstrlenW (lpString="cmd.exe") returned 7 [0060.689] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.689] lstrlenW (lpString="conhost.exe") returned 11 [0060.689] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.690] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.690] Process32NextW (in: hSnapshot=0x184, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0060.691] CloseHandle (hObject=0x184) returned 1 [0060.691] Sleep (dwMilliseconds=0x1f4) [0061.299] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660530 [0061.299] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0061.300] GetLastError () returned 0xea [0061.300] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x123e) returned 0x3f2a090 [0061.300] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2a090, cbBufSize=0x123e, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2a090, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0061.300] CloseServiceHandle (hSCObject=0x660530) returned 1 [0061.301] lstrlenW (lpString="Appinfo") returned 7 [0061.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.301] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.301] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.301] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.301] lstrlenW (lpString="AudioSrv") returned 8 [0061.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.301] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.301] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.301] lstrlenW (lpString="BFE") returned 3 [0061.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.301] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.301] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.302] lstrlenW (lpString="CryptSvc") returned 8 [0061.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.302] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.302] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.302] lstrlenW (lpString="CscService") returned 10 [0061.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.302] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.302] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.302] lstrlenW (lpString="DcomLaunch") returned 10 [0061.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.302] lstrlenW (lpString="Dhcp") returned 4 [0061.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.302] lstrlenW (lpString="Dnscache") returned 8 [0061.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.303] lstrlenW (lpString="DPS") returned 3 [0061.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.303] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.303] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.303] lstrlenW (lpString="eventlog") returned 8 [0061.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.303] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.303] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.303] lstrlenW (lpString="EventSystem") returned 11 [0061.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.303] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.303] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.303] lstrlenW (lpString="gpsvc") returned 5 [0061.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.303] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.303] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.303] lstrlenW (lpString="iphlpsvc") returned 8 [0061.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.304] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.304] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.304] lstrlenW (lpString="LanmanServer") returned 12 [0061.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.304] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.304] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.304] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.304] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.304] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.304] lstrlenW (lpString="lmhosts") returned 7 [0061.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.304] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.304] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.304] lstrlenW (lpString="MMCSS") returned 5 [0061.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.304] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.304] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.304] lstrlenW (lpString="MpsSvc") returned 6 [0061.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.305] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.305] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.305] lstrlenW (lpString="Netman") returned 6 [0061.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.305] lstrlenW (lpString="netprofm") returned 8 [0061.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.305] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.305] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.305] lstrlenW (lpString="NlaSvc") returned 6 [0061.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.306] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.306] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.306] lstrlenW (lpString="nsi") returned 3 [0061.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.306] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.306] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.306] lstrlenW (lpString="PcaSvc") returned 6 [0061.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.306] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.306] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.306] lstrlenW (lpString="PlugPlay") returned 8 [0061.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.306] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.306] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.306] lstrlenW (lpString="Power") returned 5 [0061.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.307] lstrlenW (lpString="ProfSvc") returned 7 [0061.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.307] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.307] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.307] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.307] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.307] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.307] lstrlenW (lpString="RpcSs") returned 5 [0061.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.307] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.307] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.307] lstrlenW (lpString="SamSs") returned 5 [0061.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.307] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.308] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.308] lstrlenW (lpString="Schedule") returned 8 [0061.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.308] lstrlenW (lpString="SENS") returned 4 [0061.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.308] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.308] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.309] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.309] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.309] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.309] lstrlenW (lpString="Spooler") returned 7 [0061.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.309] lstrlenW (lpString="SysMain") returned 7 [0061.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.309] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.309] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.309] lstrlenW (lpString="Themes") returned 6 [0061.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.309] lstrlenW (lpString="TrkWks") returned 6 [0061.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.310] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.310] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.310] lstrlenW (lpString="UxSms") returned 5 [0061.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.310] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.310] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.310] lstrlenW (lpString="VSS") returned 3 [0061.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0061.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0061.310] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0061.310] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0061.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0061.313] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.313] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.313] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.313] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.313] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.313] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.313] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.314] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.314] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.314] lstrlenW (lpString="Winmgmt") returned 7 [0061.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.314] lstrlenW (lpString="WPDBusEnum") returned 10 [0061.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.314] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0061.314] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0061.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0061.314] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f2a090 | out: hHeap=0x5e0000) returned 1 [0061.314] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0061.317] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.317] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.318] lstrlenW (lpString="System") returned 6 [0061.318] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.318] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.318] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.318] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.318] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0061.318] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0061.318] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0061.318] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.319] lstrlenW (lpString="smss.exe") returned 8 [0061.319] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0061.319] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0061.319] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0061.319] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0061.319] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0061.319] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0061.319] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0061.319] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.320] lstrlenW (lpString="csrss.exe") returned 9 [0061.320] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.320] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.320] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.320] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.320] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.320] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0061.320] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0061.320] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.321] lstrlenW (lpString="wininit.exe") returned 11 [0061.321] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0061.321] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0061.321] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0061.321] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0061.321] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0061.321] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0061.321] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0061.321] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.322] lstrlenW (lpString="csrss.exe") returned 9 [0061.322] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.322] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.323] lstrlenW (lpString="winlogon.exe") returned 12 [0061.323] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.323] lstrlenW (lpString="services.exe") returned 12 [0061.323] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.324] lstrlenW (lpString="lsass.exe") returned 9 [0061.324] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.325] lstrlenW (lpString="lsm.exe") returned 7 [0061.325] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.325] lstrlenW (lpString="svchost.exe") returned 11 [0061.325] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.326] lstrlenW (lpString="svchost.exe") returned 11 [0061.326] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.327] lstrlenW (lpString="svchost.exe") returned 11 [0061.327] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.328] lstrlenW (lpString="svchost.exe") returned 11 [0061.328] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.328] lstrlenW (lpString="svchost.exe") returned 11 [0061.328] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.329] lstrlenW (lpString="audiodg.exe") returned 11 [0061.329] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.330] lstrlenW (lpString="svchost.exe") returned 11 [0061.330] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.330] lstrlenW (lpString="svchost.exe") returned 11 [0061.331] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.331] lstrlenW (lpString="dwm.exe") returned 7 [0061.331] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.332] lstrlenW (lpString="explorer.exe") returned 12 [0061.332] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.333] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.333] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.333] lstrlenW (lpString="taskhost.exe") returned 12 [0061.333] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.334] lstrlenW (lpString="svchost.exe") returned 11 [0061.334] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.335] lstrlenW (lpString="taskeng.exe") returned 11 [0061.335] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.335] lstrlenW (lpString="taskhost.exe") returned 12 [0061.335] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0061.336] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0061.336] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0061.525] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0061.525] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0061.525] lstrlenW (lpString="rides.exe") returned 9 [0061.525] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0061.526] lstrlenW (lpString="logos.exe") returned 9 [0061.526] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0061.527] lstrlenW (lpString="blades.exe") returned 10 [0061.527] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0061.527] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0061.527] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0061.528] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0061.528] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0061.528] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0061.528] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0061.529] lstrlenW (lpString="zealand.exe") returned 11 [0061.529] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0061.529] lstrlenW (lpString="donate.exe") returned 10 [0061.529] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0061.530] lstrlenW (lpString="release_county.exe") returned 18 [0061.530] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0061.530] lstrlenW (lpString="merit.exe") returned 9 [0061.530] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0061.531] lstrlenW (lpString="controversial.exe") returned 17 [0061.531] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0061.531] lstrlenW (lpString="likelihood.exe") returned 14 [0061.531] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0061.532] lstrlenW (lpString="rugby bean.exe") returned 14 [0061.532] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0061.533] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0061.533] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0061.533] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0061.534] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0061.534] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0061.534] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0061.535] lstrlenW (lpString="frankfurt.exe") returned 13 [0061.535] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0061.536] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0061.536] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0061.536] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0061.536] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.537] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.537] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0061.538] lstrlenW (lpString="svhost.exe") returned 10 [0061.538] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.538] lstrlenW (lpString="cmd.exe") returned 7 [0061.538] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.539] lstrlenW (lpString="conhost.exe") returned 11 [0061.539] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.540] lstrlenW (lpString="vssadmin.exe") returned 12 [0061.540] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0061.541] lstrlenW (lpString="VSSVC.exe") returned 9 [0061.541] Process32NextW (in: hSnapshot=0x1cc, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0061.541] CloseHandle (hObject=0x1cc) returned 1 [0061.541] Sleep (dwMilliseconds=0x1f4) [0062.169] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660530 [0062.170] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0062.170] GetLastError () returned 0xea [0062.170] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x123e) returned 0x3f2a090 [0062.170] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2a090, cbBufSize=0x123e, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2a090, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0062.171] CloseServiceHandle (hSCObject=0x660530) returned 1 [0062.171] lstrlenW (lpString="Appinfo") returned 7 [0062.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.171] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.172] lstrlenW (lpString="AudioSrv") returned 8 [0062.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.172] lstrlenW (lpString="BFE") returned 3 [0062.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.172] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.172] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.172] lstrlenW (lpString="CryptSvc") returned 8 [0062.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.172] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.172] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.172] lstrlenW (lpString="CscService") returned 10 [0062.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.172] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.172] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.173] lstrlenW (lpString="DcomLaunch") returned 10 [0062.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.173] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.173] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.173] lstrlenW (lpString="Dhcp") returned 4 [0062.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.173] lstrlenW (lpString="Dnscache") returned 8 [0062.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.173] lstrlenW (lpString="DPS") returned 3 [0062.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.173] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.173] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.173] lstrlenW (lpString="eventlog") returned 8 [0062.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.174] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.174] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.174] lstrlenW (lpString="EventSystem") returned 11 [0062.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.174] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.174] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.174] lstrlenW (lpString="gpsvc") returned 5 [0062.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.174] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.174] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.174] lstrlenW (lpString="iphlpsvc") returned 8 [0062.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.174] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.174] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.174] lstrlenW (lpString="LanmanServer") returned 12 [0062.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.175] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.175] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.175] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.175] lstrlenW (lpString="lmhosts") returned 7 [0062.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.175] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.175] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.175] lstrlenW (lpString="MMCSS") returned 5 [0062.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.175] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.175] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.176] lstrlenW (lpString="MpsSvc") returned 6 [0062.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.176] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.176] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.176] lstrlenW (lpString="Netman") returned 6 [0062.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.176] lstrlenW (lpString="netprofm") returned 8 [0062.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.176] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.177] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.177] lstrlenW (lpString="NlaSvc") returned 6 [0062.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.177] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.177] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.177] lstrlenW (lpString="nsi") returned 3 [0062.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.177] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.177] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.177] lstrlenW (lpString="PcaSvc") returned 6 [0062.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.177] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.177] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.178] lstrlenW (lpString="PlugPlay") returned 8 [0062.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.178] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.178] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.178] lstrlenW (lpString="Power") returned 5 [0062.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.178] lstrlenW (lpString="ProfSvc") returned 7 [0062.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.178] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.178] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.178] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.179] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.179] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.179] lstrlenW (lpString="RpcSs") returned 5 [0062.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.185] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.187] lstrlenW (lpString="SamSs") returned 5 [0062.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.188] lstrlenW (lpString="Schedule") returned 8 [0062.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.188] lstrlenW (lpString="SENS") returned 4 [0062.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.188] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.188] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.188] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.188] lstrlenW (lpString="Spooler") returned 7 [0062.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.189] lstrlenW (lpString="SysMain") returned 7 [0062.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.189] lstrlenW (lpString="Themes") returned 6 [0062.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.189] lstrlenW (lpString="TrkWks") returned 6 [0062.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.189] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.189] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.189] lstrlenW (lpString="UxSms") returned 5 [0062.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.189] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.189] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.189] lstrlenW (lpString="VSS") returned 3 [0062.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0062.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0062.189] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0062.189] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0062.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0062.190] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.190] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.190] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.190] lstrlenW (lpString="Winmgmt") returned 7 [0062.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.190] lstrlenW (lpString="WPDBusEnum") returned 10 [0062.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0062.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0062.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0062.191] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f2a090 | out: hHeap=0x5e0000) returned 1 [0062.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0062.193] Process32FirstW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.193] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.194] lstrlenW (lpString="System") returned 6 [0062.194] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.194] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.194] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.194] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.194] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.194] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.194] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.194] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.195] lstrlenW (lpString="smss.exe") returned 8 [0062.195] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.195] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.195] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.195] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.195] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.195] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.195] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.195] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.196] lstrlenW (lpString="csrss.exe") returned 9 [0062.196] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.196] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.196] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.196] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.196] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.196] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.196] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0062.196] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.197] lstrlenW (lpString="wininit.exe") returned 11 [0062.197] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0062.197] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0062.197] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0062.197] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0062.197] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0062.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0062.197] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0062.197] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.198] lstrlenW (lpString="csrss.exe") returned 9 [0062.198] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.198] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.198] lstrlenW (lpString="winlogon.exe") returned 12 [0062.199] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.199] lstrlenW (lpString="services.exe") returned 12 [0062.199] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.200] lstrlenW (lpString="lsass.exe") returned 9 [0062.200] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.200] lstrlenW (lpString="lsm.exe") returned 7 [0062.200] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.201] lstrlenW (lpString="svchost.exe") returned 11 [0062.201] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.202] lstrlenW (lpString="svchost.exe") returned 11 [0062.202] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.202] lstrlenW (lpString="svchost.exe") returned 11 [0062.202] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.203] lstrlenW (lpString="svchost.exe") returned 11 [0062.203] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.204] lstrlenW (lpString="svchost.exe") returned 11 [0062.204] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.204] lstrlenW (lpString="audiodg.exe") returned 11 [0062.204] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.205] lstrlenW (lpString="svchost.exe") returned 11 [0062.205] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.206] lstrlenW (lpString="svchost.exe") returned 11 [0062.206] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.206] lstrlenW (lpString="dwm.exe") returned 7 [0062.206] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.207] lstrlenW (lpString="explorer.exe") returned 12 [0062.207] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.207] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.207] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.208] lstrlenW (lpString="taskhost.exe") returned 12 [0062.208] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.209] lstrlenW (lpString="svchost.exe") returned 11 [0062.209] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.209] lstrlenW (lpString="taskeng.exe") returned 11 [0062.209] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.210] lstrlenW (lpString="taskhost.exe") returned 12 [0062.210] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0065.951] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0065.951] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0065.951] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0065.952] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0065.952] lstrlenW (lpString="rides.exe") returned 9 [0065.952] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0065.953] lstrlenW (lpString="logos.exe") returned 9 [0065.953] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0065.953] lstrlenW (lpString="blades.exe") returned 10 [0065.953] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0065.954] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0065.954] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0065.955] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0065.955] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0065.956] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0065.956] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0065.956] lstrlenW (lpString="zealand.exe") returned 11 [0065.956] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0065.957] lstrlenW (lpString="donate.exe") returned 10 [0065.957] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0065.958] lstrlenW (lpString="release_county.exe") returned 18 [0065.958] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0065.958] lstrlenW (lpString="merit.exe") returned 9 [0065.958] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0065.959] lstrlenW (lpString="controversial.exe") returned 17 [0065.959] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0065.960] lstrlenW (lpString="likelihood.exe") returned 14 [0065.960] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0065.960] lstrlenW (lpString="rugby bean.exe") returned 14 [0065.960] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0065.961] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0065.961] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0065.962] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0065.962] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0065.962] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0065.962] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0065.963] lstrlenW (lpString="frankfurt.exe") returned 13 [0065.963] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0065.963] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0065.964] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0065.964] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0065.964] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0065.965] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0065.965] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0065.965] lstrlenW (lpString="svhost.exe") returned 10 [0065.965] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.966] lstrlenW (lpString="cmd.exe") returned 7 [0065.966] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.967] lstrlenW (lpString="conhost.exe") returned 11 [0065.967] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0065.967] lstrlenW (lpString="vssadmin.exe") returned 12 [0065.967] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0065.968] lstrlenW (lpString="VSSVC.exe") returned 9 [0065.968] Process32NextW (in: hSnapshot=0x190, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0065.969] CloseHandle (hObject=0x190) returned 1 [0065.969] Sleep (dwMilliseconds=0x1f4) [0066.672] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660530 [0066.672] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0066.672] GetLastError () returned 0xea [0066.672] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x123e) returned 0x3f2a090 [0066.673] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2a090, cbBufSize=0x123e, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2a090, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0066.673] CloseServiceHandle (hSCObject=0x660530) returned 1 [0066.673] lstrlenW (lpString="Appinfo") returned 7 [0066.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0066.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0066.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0066.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0066.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0066.673] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0066.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.673] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0066.673] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0066.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0066.673] lstrlenW (lpString="AudioSrv") returned 8 [0066.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0066.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0066.674] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0066.674] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0066.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0066.674] lstrlenW (lpString="BFE") returned 3 [0066.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0066.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0066.674] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0066.674] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0066.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0066.674] lstrlenW (lpString="CryptSvc") returned 8 [0066.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0066.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0066.674] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0066.674] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0066.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0066.674] lstrlenW (lpString="CscService") returned 10 [0066.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0066.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0066.674] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0066.674] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0066.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0066.674] lstrlenW (lpString="DcomLaunch") returned 10 [0066.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.674] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0066.674] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0066.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0066.674] lstrlenW (lpString="Dhcp") returned 4 [0066.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0066.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0066.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0066.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0066.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0066.674] lstrlenW (lpString="Dnscache") returned 8 [0066.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0066.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0066.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0066.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0066.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0066.674] lstrlenW (lpString="DPS") returned 3 [0066.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0066.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0066.675] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0066.675] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0066.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0066.675] lstrlenW (lpString="eventlog") returned 8 [0066.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0066.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0066.675] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0066.675] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0066.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0066.675] lstrlenW (lpString="EventSystem") returned 11 [0066.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0066.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0066.675] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0066.675] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0066.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0066.675] lstrlenW (lpString="gpsvc") returned 5 [0066.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0066.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0066.675] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0066.675] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0066.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0066.675] lstrlenW (lpString="iphlpsvc") returned 8 [0066.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.675] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0066.675] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0066.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0066.675] lstrlenW (lpString="LanmanServer") returned 12 [0066.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0066.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0066.675] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0066.675] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0066.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0066.675] lstrlenW (lpString="LanmanWorkstation") returned 17 [0066.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.675] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0066.676] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0066.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0066.676] lstrlenW (lpString="lmhosts") returned 7 [0066.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0066.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0066.676] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0066.676] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0066.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0066.676] lstrlenW (lpString="MMCSS") returned 5 [0066.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0066.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0066.676] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0066.676] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0066.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0066.676] lstrlenW (lpString="MpsSvc") returned 6 [0066.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0066.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0066.676] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0066.676] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0066.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0066.676] lstrlenW (lpString="Netman") returned 6 [0066.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0066.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0066.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0066.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0066.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0066.676] lstrlenW (lpString="netprofm") returned 8 [0066.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0066.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0066.676] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0066.676] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0066.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0066.676] lstrlenW (lpString="NlaSvc") returned 6 [0066.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0066.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0066.676] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0066.676] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0066.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0066.676] lstrlenW (lpString="nsi") returned 3 [0066.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0066.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0066.677] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0066.677] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0066.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0066.677] lstrlenW (lpString="PcaSvc") returned 6 [0066.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0066.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0066.677] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0066.677] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0066.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0066.677] lstrlenW (lpString="PlugPlay") returned 8 [0066.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0066.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0066.677] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0066.677] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0066.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0066.677] lstrlenW (lpString="Power") returned 5 [0066.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0066.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0066.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0066.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0066.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0066.677] lstrlenW (lpString="ProfSvc") returned 7 [0066.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0066.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0066.677] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0066.677] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0066.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0066.677] lstrlenW (lpString="RpcEptMapper") returned 12 [0066.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.677] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0066.677] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0066.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0066.677] lstrlenW (lpString="RpcSs") returned 5 [0066.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0066.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0066.677] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0066.677] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0066.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0066.678] lstrlenW (lpString="SamSs") returned 5 [0066.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0066.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0066.678] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0066.678] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0066.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0066.678] lstrlenW (lpString="Schedule") returned 8 [0066.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0066.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0066.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0066.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0066.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0066.678] lstrlenW (lpString="SENS") returned 4 [0066.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0066.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0066.678] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0066.678] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0066.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0066.678] lstrlenW (lpString="ShellHWDetection") returned 16 [0066.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.678] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0066.678] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0066.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0066.678] lstrlenW (lpString="Spooler") returned 7 [0066.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0066.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0066.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0066.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0066.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0066.678] lstrlenW (lpString="SysMain") returned 7 [0066.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0066.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0066.678] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0066.678] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0066.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0066.678] lstrlenW (lpString="Themes") returned 6 [0066.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0066.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0066.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0066.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0066.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0066.679] lstrlenW (lpString="TrkWks") returned 6 [0066.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0066.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0066.679] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0066.679] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0066.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0066.679] lstrlenW (lpString="UxSms") returned 5 [0066.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0066.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0066.679] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0066.679] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0066.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0066.679] lstrlenW (lpString="VSS") returned 3 [0066.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0066.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0066.679] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0066.679] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0066.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0066.679] lstrlenW (lpString="WdiServiceHost") returned 14 [0066.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0066.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0066.679] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0066.679] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0066.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0066.679] lstrlenW (lpString="WdiSystemHost") returned 13 [0066.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0066.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0066.679] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0066.679] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0066.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0066.679] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0066.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0066.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0066.679] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0066.679] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0066.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0066.680] lstrlenW (lpString="Winmgmt") returned 7 [0066.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0066.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0066.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0066.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0066.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0066.680] lstrlenW (lpString="WPDBusEnum") returned 10 [0066.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0066.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0066.680] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0066.680] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0066.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0066.680] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f2a090 | out: hHeap=0x5e0000) returned 1 [0066.680] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0066.682] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.682] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.682] lstrlenW (lpString="System") returned 6 [0066.682] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0066.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0066.683] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0066.683] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0066.683] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0066.683] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0066.683] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0066.683] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.683] lstrlenW (lpString="smss.exe") returned 8 [0066.683] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0066.683] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0066.683] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0066.683] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0066.683] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0066.683] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0066.683] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0066.683] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.684] lstrlenW (lpString="csrss.exe") returned 9 [0066.684] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0066.684] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0066.684] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0066.684] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0066.684] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0066.684] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0066.684] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0066.684] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.684] lstrlenW (lpString="wininit.exe") returned 11 [0066.684] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0066.684] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0066.684] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0066.685] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0066.685] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0066.685] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0066.685] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0066.685] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.685] lstrlenW (lpString="csrss.exe") returned 9 [0066.685] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0066.685] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.686] lstrlenW (lpString="winlogon.exe") returned 12 [0066.686] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.686] lstrlenW (lpString="services.exe") returned 12 [0066.686] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.687] lstrlenW (lpString="lsass.exe") returned 9 [0066.687] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0066.687] lstrlenW (lpString="lsm.exe") returned 7 [0066.687] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.688] lstrlenW (lpString="svchost.exe") returned 11 [0066.688] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.688] lstrlenW (lpString="svchost.exe") returned 11 [0066.688] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.689] lstrlenW (lpString="svchost.exe") returned 11 [0066.689] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.689] lstrlenW (lpString="svchost.exe") returned 11 [0066.689] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.690] lstrlenW (lpString="svchost.exe") returned 11 [0066.690] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.690] lstrlenW (lpString="audiodg.exe") returned 11 [0066.690] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.691] lstrlenW (lpString="svchost.exe") returned 11 [0066.691] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.691] lstrlenW (lpString="svchost.exe") returned 11 [0066.691] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.692] lstrlenW (lpString="dwm.exe") returned 7 [0066.692] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.692] lstrlenW (lpString="explorer.exe") returned 12 [0066.692] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.692] lstrlenW (lpString="spoolsv.exe") returned 11 [0066.693] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.693] lstrlenW (lpString="taskhost.exe") returned 12 [0066.693] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.693] lstrlenW (lpString="svchost.exe") returned 11 [0066.693] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0066.694] lstrlenW (lpString="taskeng.exe") returned 11 [0066.694] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.694] lstrlenW (lpString="taskhost.exe") returned 12 [0066.694] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0066.695] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0066.695] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0066.695] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0066.695] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0066.696] lstrlenW (lpString="rides.exe") returned 9 [0066.696] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0066.696] lstrlenW (lpString="logos.exe") returned 9 [0066.696] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0066.697] lstrlenW (lpString="blades.exe") returned 10 [0066.697] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0066.697] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0066.697] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0066.698] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0066.698] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0066.698] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0066.698] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0066.699] lstrlenW (lpString="zealand.exe") returned 11 [0066.699] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0066.699] lstrlenW (lpString="donate.exe") returned 10 [0066.699] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0066.700] lstrlenW (lpString="release_county.exe") returned 18 [0066.700] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0066.700] lstrlenW (lpString="merit.exe") returned 9 [0066.700] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0066.701] lstrlenW (lpString="controversial.exe") returned 17 [0066.701] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0066.701] lstrlenW (lpString="likelihood.exe") returned 14 [0066.701] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0066.702] lstrlenW (lpString="rugby bean.exe") returned 14 [0066.702] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0066.702] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0066.702] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0066.703] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0066.703] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0066.703] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0066.703] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0066.704] lstrlenW (lpString="frankfurt.exe") returned 13 [0066.704] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0066.704] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0066.704] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0066.705] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0066.705] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.705] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.705] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0066.706] lstrlenW (lpString="svhost.exe") returned 10 [0066.706] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.706] lstrlenW (lpString="cmd.exe") returned 7 [0066.706] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.707] lstrlenW (lpString="conhost.exe") returned 11 [0066.707] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0066.707] lstrlenW (lpString="vssadmin.exe") returned 12 [0066.707] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0066.708] lstrlenW (lpString="VSSVC.exe") returned 9 [0066.708] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0066.708] CloseHandle (hObject=0x1a4) returned 1 [0066.709] Sleep (dwMilliseconds=0x1f4) [0067.218] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660530 [0067.218] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0067.219] GetLastError () returned 0xea [0067.219] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x123e) returned 0x3f2a090 [0067.219] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2a090, cbBufSize=0x123e, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2a090, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0067.219] CloseServiceHandle (hSCObject=0x660530) returned 1 [0067.219] lstrlenW (lpString="Appinfo") returned 7 [0067.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0067.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0067.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0067.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0067.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0067.220] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0067.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.220] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0067.220] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0067.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0067.220] lstrlenW (lpString="AudioSrv") returned 8 [0067.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0067.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0067.220] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0067.220] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0067.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0067.220] lstrlenW (lpString="BFE") returned 3 [0067.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0067.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0067.220] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0067.220] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0067.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0067.220] lstrlenW (lpString="CryptSvc") returned 8 [0067.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0067.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0067.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0067.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0067.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0067.220] lstrlenW (lpString="CscService") returned 10 [0067.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0067.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0067.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0067.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0067.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0067.220] lstrlenW (lpString="DcomLaunch") returned 10 [0067.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0067.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0067.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0067.221] lstrlenW (lpString="Dhcp") returned 4 [0067.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0067.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0067.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0067.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0067.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0067.221] lstrlenW (lpString="Dnscache") returned 8 [0067.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0067.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0067.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0067.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0067.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0067.221] lstrlenW (lpString="DPS") returned 3 [0067.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0067.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0067.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0067.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0067.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0067.221] lstrlenW (lpString="eventlog") returned 8 [0067.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0067.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0067.222] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0067.222] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0067.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0067.222] lstrlenW (lpString="EventSystem") returned 11 [0067.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0067.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0067.222] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0067.222] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0067.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0067.222] lstrlenW (lpString="gpsvc") returned 5 [0067.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0067.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0067.222] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0067.222] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0067.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0067.222] lstrlenW (lpString="iphlpsvc") returned 8 [0067.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.222] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0067.222] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0067.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0067.222] lstrlenW (lpString="LanmanServer") returned 12 [0067.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0067.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0067.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0067.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0067.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0067.222] lstrlenW (lpString="LanmanWorkstation") returned 17 [0067.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0067.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0067.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0067.223] lstrlenW (lpString="lmhosts") returned 7 [0067.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0067.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0067.223] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0067.223] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0067.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0067.223] lstrlenW (lpString="MMCSS") returned 5 [0067.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0067.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0067.223] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0067.223] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0067.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0067.223] lstrlenW (lpString="MpsSvc") returned 6 [0067.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.223] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.223] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.223] lstrlenW (lpString="Netman") returned 6 [0067.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0067.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0067.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0067.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0067.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0067.223] lstrlenW (lpString="netprofm") returned 8 [0067.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.223] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.223] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.223] lstrlenW (lpString="NlaSvc") returned 6 [0067.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.223] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.224] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.224] lstrlenW (lpString="nsi") returned 3 [0067.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.224] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.224] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.224] lstrlenW (lpString="PcaSvc") returned 6 [0067.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.224] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.224] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.224] lstrlenW (lpString="PlugPlay") returned 8 [0067.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.224] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.224] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.224] lstrlenW (lpString="Power") returned 5 [0067.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.224] lstrlenW (lpString="ProfSvc") returned 7 [0067.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.224] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.224] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.224] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.225] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.225] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.225] lstrlenW (lpString="RpcSs") returned 5 [0067.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.225] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.225] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.225] lstrlenW (lpString="SamSs") returned 5 [0067.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.225] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.225] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.225] lstrlenW (lpString="Schedule") returned 8 [0067.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.225] lstrlenW (lpString="SENS") returned 4 [0067.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.225] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.225] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.225] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.225] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.225] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.226] lstrlenW (lpString="Spooler") returned 7 [0067.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.226] lstrlenW (lpString="SysMain") returned 7 [0067.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.226] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.226] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0067.226] lstrlenW (lpString="Themes") returned 6 [0067.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0067.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0067.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0067.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0067.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0067.226] lstrlenW (lpString="TrkWks") returned 6 [0067.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0067.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0067.226] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0067.226] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0067.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0067.226] lstrlenW (lpString="UxSms") returned 5 [0067.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0067.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0067.226] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0067.227] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0067.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0067.227] lstrlenW (lpString="VSS") returned 3 [0067.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0067.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0067.227] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0067.227] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0067.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0067.227] lstrlenW (lpString="WdiServiceHost") returned 14 [0067.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.227] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0067.227] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0067.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0067.227] lstrlenW (lpString="WdiSystemHost") returned 13 [0067.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.227] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0067.227] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0067.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0067.227] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0067.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.227] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0067.227] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0067.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0067.227] lstrlenW (lpString="Winmgmt") returned 7 [0067.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0067.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0067.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0067.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0067.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0067.228] lstrlenW (lpString="WPDBusEnum") returned 10 [0067.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.228] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0067.228] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0067.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0067.228] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f2a090 | out: hHeap=0x5e0000) returned 1 [0067.228] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0067.230] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.230] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.231] lstrlenW (lpString="System") returned 6 [0067.231] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0067.231] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0067.231] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0067.231] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0067.231] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0067.231] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0067.231] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0067.231] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.231] lstrlenW (lpString="smss.exe") returned 8 [0067.231] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0067.231] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0067.232] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0067.232] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0067.232] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0067.232] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0067.232] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0067.232] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.232] lstrlenW (lpString="csrss.exe") returned 9 [0067.232] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.232] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.232] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.232] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.232] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.232] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0067.232] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0067.232] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.233] lstrlenW (lpString="wininit.exe") returned 11 [0067.233] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0067.233] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0067.233] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0067.233] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0067.233] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0067.233] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0067.233] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0067.233] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.234] lstrlenW (lpString="csrss.exe") returned 9 [0067.234] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.234] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.234] lstrlenW (lpString="winlogon.exe") returned 12 [0067.234] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.235] lstrlenW (lpString="services.exe") returned 12 [0067.235] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.235] lstrlenW (lpString="lsass.exe") returned 9 [0067.235] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0067.236] lstrlenW (lpString="lsm.exe") returned 7 [0067.236] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.237] lstrlenW (lpString="svchost.exe") returned 11 [0067.237] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.238] lstrlenW (lpString="svchost.exe") returned 11 [0067.238] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.238] lstrlenW (lpString="svchost.exe") returned 11 [0067.238] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.239] lstrlenW (lpString="svchost.exe") returned 11 [0067.239] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.240] lstrlenW (lpString="svchost.exe") returned 11 [0067.240] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.241] lstrlenW (lpString="audiodg.exe") returned 11 [0067.241] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.243] lstrlenW (lpString="svchost.exe") returned 11 [0067.243] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.244] lstrlenW (lpString="svchost.exe") returned 11 [0067.244] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.245] lstrlenW (lpString="dwm.exe") returned 7 [0067.245] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.245] lstrlenW (lpString="explorer.exe") returned 12 [0067.245] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.246] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.246] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.247] lstrlenW (lpString="taskhost.exe") returned 12 [0067.247] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.248] lstrlenW (lpString="svchost.exe") returned 11 [0067.248] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0067.248] lstrlenW (lpString="taskeng.exe") returned 11 [0067.248] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.249] lstrlenW (lpString="taskhost.exe") returned 12 [0067.249] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0067.250] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0067.250] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0067.250] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0067.250] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0067.251] lstrlenW (lpString="rides.exe") returned 9 [0067.251] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0067.251] lstrlenW (lpString="logos.exe") returned 9 [0067.251] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0067.252] lstrlenW (lpString="blades.exe") returned 10 [0067.252] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0067.253] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0067.253] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0067.253] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0067.253] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0067.254] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0067.254] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0067.254] lstrlenW (lpString="zealand.exe") returned 11 [0067.254] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0067.255] lstrlenW (lpString="donate.exe") returned 10 [0067.255] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0067.255] lstrlenW (lpString="release_county.exe") returned 18 [0067.255] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0067.256] lstrlenW (lpString="merit.exe") returned 9 [0067.256] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0067.257] lstrlenW (lpString="controversial.exe") returned 17 [0067.257] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0067.257] lstrlenW (lpString="likelihood.exe") returned 14 [0067.257] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0067.258] lstrlenW (lpString="rugby bean.exe") returned 14 [0067.258] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0067.258] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0067.258] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0067.259] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0067.259] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0067.259] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0067.259] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0067.260] lstrlenW (lpString="frankfurt.exe") returned 13 [0067.260] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0067.260] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0067.260] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0067.261] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0067.261] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.261] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.261] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0067.262] lstrlenW (lpString="svhost.exe") returned 10 [0067.262] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.262] lstrlenW (lpString="cmd.exe") returned 7 [0067.262] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.263] lstrlenW (lpString="conhost.exe") returned 11 [0067.263] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0067.263] lstrlenW (lpString="vssadmin.exe") returned 12 [0067.263] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0067.264] lstrlenW (lpString="VSSVC.exe") returned 9 [0067.264] Process32NextW (in: hSnapshot=0x1a4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0067.264] CloseHandle (hObject=0x1a4) returned 1 [0067.264] Sleep (dwMilliseconds=0x1f4) [0067.780] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660530 [0067.780] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0067.780] GetLastError () returned 0xea [0067.781] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12c6) returned 0x3f2a090 [0067.781] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2a090, cbBufSize=0x12c6, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2a090, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0067.781] CloseServiceHandle (hSCObject=0x660530) returned 1 [0067.781] lstrlenW (lpString="Appinfo") returned 7 [0067.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0067.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0067.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0067.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0067.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0067.781] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0067.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.781] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0067.781] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0067.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0067.781] lstrlenW (lpString="AudioSrv") returned 8 [0067.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0067.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0067.782] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0067.782] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0067.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0067.782] lstrlenW (lpString="BFE") returned 3 [0067.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0067.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0067.782] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0067.782] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0067.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0067.782] lstrlenW (lpString="CryptSvc") returned 8 [0067.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0067.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0067.782] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0067.782] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0067.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0067.782] lstrlenW (lpString="CscService") returned 10 [0067.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0067.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0067.782] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0067.782] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0067.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0067.782] lstrlenW (lpString="DcomLaunch") returned 10 [0067.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.782] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0067.782] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0067.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0067.782] lstrlenW (lpString="Dhcp") returned 4 [0067.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0067.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0067.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0067.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0067.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0067.782] lstrlenW (lpString="Dnscache") returned 8 [0067.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0067.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0067.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0067.783] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0067.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0067.783] lstrlenW (lpString="DPS") returned 3 [0067.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0067.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0067.783] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0067.783] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0067.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0067.783] lstrlenW (lpString="eventlog") returned 8 [0067.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0067.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0067.783] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0067.783] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0067.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0067.783] lstrlenW (lpString="EventSystem") returned 11 [0067.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0067.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0067.783] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0067.783] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0067.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0067.783] lstrlenW (lpString="gpsvc") returned 5 [0067.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0067.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0067.783] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0067.783] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0067.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0067.783] lstrlenW (lpString="iphlpsvc") returned 8 [0067.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.783] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0067.783] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0067.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0067.783] lstrlenW (lpString="LanmanServer") returned 12 [0067.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0067.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0067.783] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0067.783] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0067.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0067.784] lstrlenW (lpString="LanmanWorkstation") returned 17 [0067.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.784] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0067.784] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0067.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0067.784] lstrlenW (lpString="lmhosts") returned 7 [0067.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0067.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0067.784] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0067.784] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0067.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0067.784] lstrlenW (lpString="MMCSS") returned 5 [0067.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0067.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0067.784] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0067.784] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0067.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0067.784] lstrlenW (lpString="MpsSvc") returned 6 [0067.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.784] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.784] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.784] lstrlenW (lpString="Netman") returned 6 [0067.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0067.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0067.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0067.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0067.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0067.784] lstrlenW (lpString="netprofm") returned 8 [0067.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.784] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.784] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.785] lstrlenW (lpString="NlaSvc") returned 6 [0067.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.785] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.785] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.785] lstrlenW (lpString="nsi") returned 3 [0067.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.785] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.785] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.785] lstrlenW (lpString="PcaSvc") returned 6 [0067.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.785] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.785] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.785] lstrlenW (lpString="PlugPlay") returned 8 [0067.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.785] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.785] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.785] lstrlenW (lpString="Power") returned 5 [0067.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.785] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.785] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.785] lstrlenW (lpString="ProfSvc") returned 7 [0067.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.785] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.785] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.785] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.786] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.786] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.786] lstrlenW (lpString="RpcSs") returned 5 [0067.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.786] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.786] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.786] lstrlenW (lpString="SamSs") returned 5 [0067.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.786] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.786] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.786] lstrlenW (lpString="Schedule") returned 8 [0067.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.786] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.786] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.786] lstrlenW (lpString="SENS") returned 4 [0067.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.786] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.786] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.786] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.786] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.786] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.786] lstrlenW (lpString="Spooler") returned 7 [0067.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.786] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.786] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.787] lstrlenW (lpString="swprv") returned 5 [0067.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0067.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0067.787] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0067.787] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0067.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0067.787] lstrlenW (lpString="SysMain") returned 7 [0067.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.787] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.787] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0067.787] lstrlenW (lpString="Themes") returned 6 [0067.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0067.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0067.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0067.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0067.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0067.787] lstrlenW (lpString="TrkWks") returned 6 [0067.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0067.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0067.787] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0067.787] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0067.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0067.787] lstrlenW (lpString="UxSms") returned 5 [0067.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0067.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0067.787] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0067.787] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0067.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0067.787] lstrlenW (lpString="VSS") returned 3 [0067.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0067.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0067.788] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0067.788] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0067.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0067.788] lstrlenW (lpString="WdiServiceHost") returned 14 [0067.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.788] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0067.788] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0067.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0067.788] lstrlenW (lpString="WdiSystemHost") returned 13 [0067.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.788] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0067.788] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0067.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0067.788] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0067.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.788] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0067.788] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0067.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0067.788] lstrlenW (lpString="Winmgmt") returned 7 [0067.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0067.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0067.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0067.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0067.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0067.788] lstrlenW (lpString="WPDBusEnum") returned 10 [0067.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.789] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0067.789] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0067.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0067.789] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f2a090 | out: hHeap=0x5e0000) returned 1 [0067.789] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0067.791] Process32FirstW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.792] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.793] lstrlenW (lpString="System") returned 6 [0067.793] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0067.793] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0067.793] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0067.793] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0067.793] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0067.793] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0067.793] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0067.793] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.794] lstrlenW (lpString="smss.exe") returned 8 [0067.794] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0067.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0067.794] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0067.794] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0067.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0067.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0067.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0067.794] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.794] lstrlenW (lpString="csrss.exe") returned 9 [0067.794] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.794] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.794] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0067.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0067.794] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.795] lstrlenW (lpString="wininit.exe") returned 11 [0067.795] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0067.795] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0067.795] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0067.795] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.796] lstrlenW (lpString="csrss.exe") returned 9 [0067.796] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.797] lstrlenW (lpString="winlogon.exe") returned 12 [0067.797] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.797] lstrlenW (lpString="services.exe") returned 12 [0067.797] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.798] lstrlenW (lpString="lsass.exe") returned 9 [0067.798] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0067.798] lstrlenW (lpString="lsm.exe") returned 7 [0067.798] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.799] lstrlenW (lpString="svchost.exe") returned 11 [0067.799] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.799] lstrlenW (lpString="svchost.exe") returned 11 [0067.799] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.813] lstrlenW (lpString="svchost.exe") returned 11 [0067.813] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.814] lstrlenW (lpString="svchost.exe") returned 11 [0067.814] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.814] lstrlenW (lpString="svchost.exe") returned 11 [0067.814] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.815] lstrlenW (lpString="audiodg.exe") returned 11 [0067.815] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.815] lstrlenW (lpString="svchost.exe") returned 11 [0067.816] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.816] lstrlenW (lpString="svchost.exe") returned 11 [0067.816] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.816] lstrlenW (lpString="dwm.exe") returned 7 [0067.817] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.817] lstrlenW (lpString="explorer.exe") returned 12 [0067.817] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.818] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.818] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.818] lstrlenW (lpString="taskhost.exe") returned 12 [0067.818] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.819] lstrlenW (lpString="svchost.exe") returned 11 [0067.819] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0067.819] lstrlenW (lpString="taskeng.exe") returned 11 [0067.819] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.820] lstrlenW (lpString="taskhost.exe") returned 12 [0067.820] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0067.820] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0067.820] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0067.821] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0067.821] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0067.821] lstrlenW (lpString="rides.exe") returned 9 [0067.821] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0067.822] lstrlenW (lpString="logos.exe") returned 9 [0067.822] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0067.822] lstrlenW (lpString="blades.exe") returned 10 [0067.822] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0067.823] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0067.823] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0067.823] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0067.823] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0067.824] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0067.824] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0067.824] lstrlenW (lpString="zealand.exe") returned 11 [0067.824] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0067.825] lstrlenW (lpString="donate.exe") returned 10 [0067.825] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0067.825] lstrlenW (lpString="release_county.exe") returned 18 [0067.825] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0067.826] lstrlenW (lpString="merit.exe") returned 9 [0067.826] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0067.826] lstrlenW (lpString="controversial.exe") returned 17 [0067.826] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0067.827] lstrlenW (lpString="likelihood.exe") returned 14 [0067.827] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0067.827] lstrlenW (lpString="rugby bean.exe") returned 14 [0067.827] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0067.828] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0067.828] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0067.828] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0067.828] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0067.829] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0067.829] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0067.829] lstrlenW (lpString="frankfurt.exe") returned 13 [0067.830] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0067.830] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0067.830] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0067.830] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0067.831] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.831] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.831] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0067.832] lstrlenW (lpString="svhost.exe") returned 10 [0067.832] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.832] lstrlenW (lpString="cmd.exe") returned 7 [0067.832] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.833] lstrlenW (lpString="conhost.exe") returned 11 [0067.833] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0067.833] lstrlenW (lpString="vssadmin.exe") returned 12 [0067.833] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0067.834] lstrlenW (lpString="VSSVC.exe") returned 9 [0067.834] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.834] lstrlenW (lpString="svchost.exe") returned 11 [0067.834] Process32NextW (in: hSnapshot=0x160, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0067.835] CloseHandle (hObject=0x160) returned 1 [0067.835] Sleep (dwMilliseconds=0x1f4) [0068.341] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660530 [0068.341] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0068.342] GetLastError () returned 0xea [0068.342] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12c6) returned 0x3f28080 [0068.342] EnumServicesStatusExW (in: hSCManager=0x660530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f28080, cbBufSize=0x12c6, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f28080, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0068.342] CloseServiceHandle (hSCObject=0x660530) returned 1 [0068.342] lstrlenW (lpString="Appinfo") returned 7 [0068.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0068.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0068.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0068.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0068.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0068.342] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0068.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.342] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0068.342] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0068.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0068.342] lstrlenW (lpString="AudioSrv") returned 8 [0068.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0068.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0068.343] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0068.343] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0068.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0068.343] lstrlenW (lpString="BFE") returned 3 [0068.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0068.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0068.343] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0068.343] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0068.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0068.343] lstrlenW (lpString="CryptSvc") returned 8 [0068.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0068.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0068.343] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0068.343] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0068.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0068.343] lstrlenW (lpString="CscService") returned 10 [0068.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0068.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0068.343] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0068.343] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0068.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0068.343] lstrlenW (lpString="DcomLaunch") returned 10 [0068.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0068.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0068.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0068.343] lstrlenW (lpString="Dhcp") returned 4 [0068.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0068.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0068.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0068.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0068.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0068.343] lstrlenW (lpString="Dnscache") returned 8 [0068.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0068.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0068.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0068.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0068.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0068.344] lstrlenW (lpString="DPS") returned 3 [0068.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0068.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0068.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0068.344] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0068.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0068.344] lstrlenW (lpString="eventlog") returned 8 [0068.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0068.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0068.344] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0068.344] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0068.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0068.344] lstrlenW (lpString="EventSystem") returned 11 [0068.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0068.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0068.344] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0068.344] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0068.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0068.344] lstrlenW (lpString="gpsvc") returned 5 [0068.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0068.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0068.344] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0068.344] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0068.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0068.344] lstrlenW (lpString="iphlpsvc") returned 8 [0068.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.344] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0068.344] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0068.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0068.344] lstrlenW (lpString="LanmanServer") returned 12 [0068.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0068.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0068.344] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0068.344] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0068.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0068.345] lstrlenW (lpString="LanmanWorkstation") returned 17 [0068.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0068.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0068.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0068.345] lstrlenW (lpString="lmhosts") returned 7 [0068.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0068.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0068.345] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0068.345] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0068.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0068.345] lstrlenW (lpString="MMCSS") returned 5 [0068.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0068.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0068.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0068.345] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0068.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0068.345] lstrlenW (lpString="MpsSvc") returned 6 [0068.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0068.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0068.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0068.345] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0068.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0068.345] lstrlenW (lpString="Netman") returned 6 [0068.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0068.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0068.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0068.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0068.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0068.345] lstrlenW (lpString="netprofm") returned 8 [0068.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0068.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0068.345] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0068.345] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0068.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0068.345] lstrlenW (lpString="NlaSvc") returned 6 [0068.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0068.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0068.346] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0068.346] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0068.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0068.346] lstrlenW (lpString="nsi") returned 3 [0068.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0068.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0068.346] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0068.346] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0068.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0068.346] lstrlenW (lpString="PcaSvc") returned 6 [0068.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0068.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0068.346] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0068.346] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0068.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0068.346] lstrlenW (lpString="PlugPlay") returned 8 [0068.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0068.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0068.346] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0068.346] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0068.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0068.346] lstrlenW (lpString="Power") returned 5 [0068.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0068.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0068.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0068.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0068.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0068.346] lstrlenW (lpString="ProfSvc") returned 7 [0068.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0068.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0068.346] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0068.346] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0068.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0068.346] lstrlenW (lpString="RpcEptMapper") returned 12 [0068.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.346] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0068.346] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0068.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0068.347] lstrlenW (lpString="RpcSs") returned 5 [0068.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0068.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0068.347] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0068.347] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0068.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0068.347] lstrlenW (lpString="SamSs") returned 5 [0068.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0068.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0068.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0068.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0068.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0068.347] lstrlenW (lpString="Schedule") returned 8 [0068.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0068.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0068.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0068.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0068.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0068.347] lstrlenW (lpString="SENS") returned 4 [0068.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0068.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0068.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0068.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0068.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0068.347] lstrlenW (lpString="ShellHWDetection") returned 16 [0068.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.347] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0068.347] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0068.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0068.347] lstrlenW (lpString="Spooler") returned 7 [0068.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0068.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0068.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0068.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0068.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0068.347] lstrlenW (lpString="swprv") returned 5 [0068.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0068.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0068.348] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0068.348] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0068.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0068.348] lstrlenW (lpString="SysMain") returned 7 [0068.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0068.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0068.348] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0068.348] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0068.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0068.348] lstrlenW (lpString="Themes") returned 6 [0068.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0068.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0068.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0068.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0068.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0068.348] lstrlenW (lpString="TrkWks") returned 6 [0068.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0068.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0068.348] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0068.348] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0068.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0068.348] lstrlenW (lpString="UxSms") returned 5 [0068.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0068.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0068.348] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0068.348] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0068.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0068.348] lstrlenW (lpString="VSS") returned 3 [0068.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0068.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0068.348] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0068.348] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0068.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0068.348] lstrlenW (lpString="WdiServiceHost") returned 14 [0068.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.348] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0068.348] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0068.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0068.349] lstrlenW (lpString="WdiSystemHost") returned 13 [0068.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.349] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0068.349] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0068.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0068.349] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0068.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.349] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0068.349] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0068.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0068.349] lstrlenW (lpString="Winmgmt") returned 7 [0068.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0068.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0068.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0068.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0068.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0068.349] lstrlenW (lpString="WPDBusEnum") returned 10 [0068.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0068.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0068.349] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0068.349] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0068.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0068.349] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f28080 | out: hHeap=0x5e0000) returned 1 [0068.349] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0068.351] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.351] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0068.352] lstrlenW (lpString="System") returned 6 [0068.352] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0068.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0068.352] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0068.352] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0068.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0068.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0068.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0068.352] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0068.353] lstrlenW (lpString="smss.exe") returned 8 [0068.353] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0068.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0068.353] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0068.353] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0068.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0068.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0068.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0068.353] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.353] lstrlenW (lpString="csrss.exe") returned 9 [0068.353] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0068.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0068.353] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0068.353] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0068.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0068.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0068.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0068.353] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0068.354] lstrlenW (lpString="wininit.exe") returned 11 [0068.354] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0068.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0068.354] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0068.354] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.354] lstrlenW (lpString="csrss.exe") returned 9 [0068.354] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0068.355] lstrlenW (lpString="winlogon.exe") returned 12 [0068.355] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0068.355] lstrlenW (lpString="services.exe") returned 12 [0068.355] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0068.356] lstrlenW (lpString="lsass.exe") returned 9 [0068.356] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0068.356] lstrlenW (lpString="lsm.exe") returned 7 [0068.356] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.357] lstrlenW (lpString="svchost.exe") returned 11 [0068.357] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.358] lstrlenW (lpString="svchost.exe") returned 11 [0068.358] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.358] lstrlenW (lpString="svchost.exe") returned 11 [0068.358] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.359] lstrlenW (lpString="svchost.exe") returned 11 [0068.359] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.359] lstrlenW (lpString="svchost.exe") returned 11 [0068.359] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0068.360] lstrlenW (lpString="audiodg.exe") returned 11 [0068.360] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.360] lstrlenW (lpString="svchost.exe") returned 11 [0068.360] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.361] lstrlenW (lpString="svchost.exe") returned 11 [0068.361] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0068.361] lstrlenW (lpString="dwm.exe") returned 7 [0068.361] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0068.362] lstrlenW (lpString="explorer.exe") returned 12 [0068.362] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0068.362] lstrlenW (lpString="spoolsv.exe") returned 11 [0068.362] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.364] lstrlenW (lpString="taskhost.exe") returned 12 [0068.364] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.364] lstrlenW (lpString="svchost.exe") returned 11 [0068.364] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0068.365] lstrlenW (lpString="taskeng.exe") returned 11 [0068.365] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.365] lstrlenW (lpString="taskhost.exe") returned 12 [0068.365] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0068.366] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0068.366] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0068.367] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0068.367] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0068.367] lstrlenW (lpString="rides.exe") returned 9 [0068.367] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0068.368] lstrlenW (lpString="logos.exe") returned 9 [0068.368] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0068.368] lstrlenW (lpString="blades.exe") returned 10 [0068.368] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0068.369] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0068.369] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0068.369] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0068.369] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0068.370] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0068.370] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0068.370] lstrlenW (lpString="zealand.exe") returned 11 [0068.370] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0068.371] lstrlenW (lpString="donate.exe") returned 10 [0068.371] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0068.371] lstrlenW (lpString="release_county.exe") returned 18 [0068.371] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0068.372] lstrlenW (lpString="merit.exe") returned 9 [0068.372] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0068.373] lstrlenW (lpString="controversial.exe") returned 17 [0068.373] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0068.373] lstrlenW (lpString="likelihood.exe") returned 14 [0068.373] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0068.374] lstrlenW (lpString="rugby bean.exe") returned 14 [0068.374] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0068.374] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0068.374] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0068.375] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0068.375] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0068.376] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0068.376] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0068.376] lstrlenW (lpString="frankfurt.exe") returned 13 [0068.376] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0068.377] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0068.377] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0068.377] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0068.377] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.378] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.378] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0068.378] lstrlenW (lpString="svhost.exe") returned 10 [0068.378] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.379] lstrlenW (lpString="cmd.exe") returned 7 [0068.379] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.379] lstrlenW (lpString="conhost.exe") returned 11 [0068.379] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0068.380] lstrlenW (lpString="vssadmin.exe") returned 12 [0068.380] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0068.380] lstrlenW (lpString="VSSVC.exe") returned 9 [0068.380] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.381] lstrlenW (lpString="svchost.exe") returned 11 [0068.381] Process32NextW (in: hSnapshot=0x1d0, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0068.381] CloseHandle (hObject=0x1d0) returned 1 [0068.381] Sleep (dwMilliseconds=0x1f4) [0069.660] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660508 [0069.661] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0069.661] GetLastError () returned 0xea [0069.661] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12c6) returned 0x3f28080 [0069.661] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f28080, cbBufSize=0x12c6, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f28080, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0069.662] CloseServiceHandle (hSCObject=0x660508) returned 1 [0069.662] lstrlenW (lpString="Appinfo") returned 7 [0069.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0069.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0069.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0069.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0069.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0069.662] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0069.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0069.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0069.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0069.662] lstrlenW (lpString="AudioSrv") returned 8 [0069.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0069.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0069.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0069.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0069.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0069.662] lstrlenW (lpString="BFE") returned 3 [0069.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0069.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0069.662] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0069.662] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0069.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0069.663] lstrlenW (lpString="CryptSvc") returned 8 [0069.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0069.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0069.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0069.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0069.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0069.663] lstrlenW (lpString="CscService") returned 10 [0069.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0069.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0069.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0069.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0069.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0069.663] lstrlenW (lpString="DcomLaunch") returned 10 [0069.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.663] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0069.663] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0069.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0069.663] lstrlenW (lpString="Dhcp") returned 4 [0069.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0069.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0069.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0069.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0069.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0069.663] lstrlenW (lpString="Dnscache") returned 8 [0069.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0069.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0069.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0069.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0069.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0069.663] lstrlenW (lpString="DPS") returned 3 [0069.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0069.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0069.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0069.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0069.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0069.664] lstrlenW (lpString="eventlog") returned 8 [0069.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0069.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0069.664] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0069.664] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0069.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0069.664] lstrlenW (lpString="EventSystem") returned 11 [0069.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0069.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0069.664] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0069.664] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0069.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0069.664] lstrlenW (lpString="gpsvc") returned 5 [0069.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0069.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0069.664] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0069.664] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0069.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0069.664] lstrlenW (lpString="iphlpsvc") returned 8 [0069.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.664] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0069.664] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0069.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0069.664] lstrlenW (lpString="LanmanServer") returned 12 [0069.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0069.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0069.664] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0069.665] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0069.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0069.665] lstrlenW (lpString="LanmanWorkstation") returned 17 [0069.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.665] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0069.665] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0069.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0069.665] lstrlenW (lpString="lmhosts") returned 7 [0069.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0069.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0069.665] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0069.665] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0069.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0069.665] lstrlenW (lpString="MMCSS") returned 5 [0069.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0069.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0069.665] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0069.665] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0069.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0069.665] lstrlenW (lpString="MpsSvc") returned 6 [0069.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0069.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0069.665] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0069.665] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0069.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0069.665] lstrlenW (lpString="Netman") returned 6 [0069.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0069.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0069.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0069.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0069.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0069.665] lstrlenW (lpString="netprofm") returned 8 [0069.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0069.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0069.666] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0069.666] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0069.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0069.666] lstrlenW (lpString="NlaSvc") returned 6 [0069.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0069.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0069.666] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0069.666] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0069.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0069.666] lstrlenW (lpString="nsi") returned 3 [0069.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0069.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0069.666] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0069.666] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0069.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0069.666] lstrlenW (lpString="PcaSvc") returned 6 [0069.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0069.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0069.666] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0069.666] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0069.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0069.666] lstrlenW (lpString="PlugPlay") returned 8 [0069.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0069.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0069.666] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0069.666] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0069.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0069.666] lstrlenW (lpString="Power") returned 5 [0069.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0069.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0069.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0069.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0069.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0069.667] lstrlenW (lpString="ProfSvc") returned 7 [0069.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0069.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0069.667] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0069.667] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0069.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0069.667] lstrlenW (lpString="RpcEptMapper") returned 12 [0069.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.667] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0069.667] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0069.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0069.667] lstrlenW (lpString="RpcSs") returned 5 [0069.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0069.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0069.667] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0069.667] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0069.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0069.667] lstrlenW (lpString="SamSs") returned 5 [0069.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0069.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0069.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0069.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0069.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0069.668] lstrlenW (lpString="Schedule") returned 8 [0069.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0069.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0069.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0069.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0069.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0069.668] lstrlenW (lpString="SENS") returned 4 [0069.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0069.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0069.668] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0069.668] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0069.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0069.668] lstrlenW (lpString="ShellHWDetection") returned 16 [0069.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.668] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0069.668] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0069.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0069.668] lstrlenW (lpString="Spooler") returned 7 [0069.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0069.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0069.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0069.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0069.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0069.668] lstrlenW (lpString="swprv") returned 5 [0069.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0069.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0069.668] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0069.669] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0069.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0069.669] lstrlenW (lpString="SysMain") returned 7 [0069.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0069.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0069.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0069.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0069.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0069.669] lstrlenW (lpString="Themes") returned 6 [0069.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0069.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0069.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0069.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0069.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0069.669] lstrlenW (lpString="TrkWks") returned 6 [0069.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0069.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0069.669] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0069.669] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0069.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0069.669] lstrlenW (lpString="UxSms") returned 5 [0069.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0069.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0069.669] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0069.669] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0069.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0069.669] lstrlenW (lpString="VSS") returned 3 [0069.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0069.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0069.669] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0069.669] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0069.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0069.669] lstrlenW (lpString="WdiServiceHost") returned 14 [0069.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.670] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0069.670] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0069.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0069.670] lstrlenW (lpString="WdiSystemHost") returned 13 [0069.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.670] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0069.670] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0069.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0069.670] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0069.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.670] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0069.670] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0069.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0069.670] lstrlenW (lpString="Winmgmt") returned 7 [0069.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0069.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0069.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0069.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0069.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0069.670] lstrlenW (lpString="WPDBusEnum") returned 10 [0069.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0069.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0069.670] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0069.670] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0069.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0069.670] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f28080 | out: hHeap=0x5e0000) returned 1 [0069.670] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0069.672] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.673] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.673] lstrlenW (lpString="System") returned 6 [0069.673] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0069.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0069.673] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0069.673] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0069.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0069.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0069.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0069.673] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.674] lstrlenW (lpString="smss.exe") returned 8 [0069.674] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0069.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0069.674] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0069.674] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0069.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0069.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0069.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0069.674] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.674] lstrlenW (lpString="csrss.exe") returned 9 [0069.674] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0069.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0069.674] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0069.674] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0069.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0069.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0069.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0069.675] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.675] lstrlenW (lpString="wininit.exe") returned 11 [0069.675] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0069.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0069.675] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0069.675] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.676] lstrlenW (lpString="csrss.exe") returned 9 [0069.676] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.676] lstrlenW (lpString="winlogon.exe") returned 12 [0069.676] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.677] lstrlenW (lpString="services.exe") returned 12 [0069.677] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.677] lstrlenW (lpString="lsass.exe") returned 9 [0069.677] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0069.678] lstrlenW (lpString="lsm.exe") returned 7 [0069.678] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.678] lstrlenW (lpString="svchost.exe") returned 11 [0069.678] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.679] lstrlenW (lpString="svchost.exe") returned 11 [0069.679] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.679] lstrlenW (lpString="svchost.exe") returned 11 [0069.679] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.680] lstrlenW (lpString="svchost.exe") returned 11 [0069.680] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.680] lstrlenW (lpString="svchost.exe") returned 11 [0069.680] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.681] lstrlenW (lpString="audiodg.exe") returned 11 [0069.681] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.681] lstrlenW (lpString="svchost.exe") returned 11 [0069.681] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.682] lstrlenW (lpString="svchost.exe") returned 11 [0069.682] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.682] lstrlenW (lpString="dwm.exe") returned 7 [0069.683] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.683] lstrlenW (lpString="explorer.exe") returned 12 [0069.683] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.684] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.684] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.684] lstrlenW (lpString="taskhost.exe") returned 12 [0069.684] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.685] lstrlenW (lpString="svchost.exe") returned 11 [0069.685] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0069.685] lstrlenW (lpString="taskeng.exe") returned 11 [0069.685] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.686] lstrlenW (lpString="taskhost.exe") returned 12 [0069.686] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0069.686] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0069.686] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0069.687] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0069.687] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0069.687] lstrlenW (lpString="rides.exe") returned 9 [0069.687] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0069.688] lstrlenW (lpString="logos.exe") returned 9 [0069.688] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0069.688] lstrlenW (lpString="blades.exe") returned 10 [0069.688] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0069.689] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0069.689] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0069.689] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0069.689] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0069.690] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0069.690] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0069.690] lstrlenW (lpString="zealand.exe") returned 11 [0069.690] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0069.691] lstrlenW (lpString="donate.exe") returned 10 [0069.691] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0069.691] lstrlenW (lpString="release_county.exe") returned 18 [0069.691] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0069.692] lstrlenW (lpString="merit.exe") returned 9 [0069.692] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0069.692] lstrlenW (lpString="controversial.exe") returned 17 [0069.692] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0069.693] lstrlenW (lpString="likelihood.exe") returned 14 [0069.693] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0069.693] lstrlenW (lpString="rugby bean.exe") returned 14 [0069.693] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0069.694] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0069.694] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0069.694] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0069.695] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0069.695] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0069.695] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0069.696] lstrlenW (lpString="frankfurt.exe") returned 13 [0069.696] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0069.696] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0069.696] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0069.697] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0069.697] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.697] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.697] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0069.698] lstrlenW (lpString="svhost.exe") returned 10 [0069.698] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.830] lstrlenW (lpString="cmd.exe") returned 7 [0069.830] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.831] lstrlenW (lpString="conhost.exe") returned 11 [0069.831] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0069.831] lstrlenW (lpString="vssadmin.exe") returned 12 [0069.832] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0069.832] lstrlenW (lpString="VSSVC.exe") returned 9 [0069.832] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.833] lstrlenW (lpString="svchost.exe") returned 11 [0069.833] Process32NextW (in: hSnapshot=0x1b4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0069.834] CloseHandle (hObject=0x1b4) returned 1 [0069.834] Sleep (dwMilliseconds=0x1f4) [0070.532] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660508 [0070.533] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0070.533] GetLastError () returned 0xea [0070.533] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12c6) returned 0x3f20078 [0070.533] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f20078, cbBufSize=0x12c6, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f20078, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0070.534] CloseServiceHandle (hSCObject=0x660508) returned 1 [0070.534] lstrlenW (lpString="Appinfo") returned 7 [0070.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0070.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0070.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0070.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0070.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0070.534] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0070.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.534] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0070.534] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0070.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0070.534] lstrlenW (lpString="AudioSrv") returned 8 [0070.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0070.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0070.535] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0070.535] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0070.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0070.535] lstrlenW (lpString="BFE") returned 3 [0070.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0070.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0070.535] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0070.535] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0070.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0070.535] lstrlenW (lpString="CryptSvc") returned 8 [0070.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0070.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0070.535] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0070.535] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0070.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0070.535] lstrlenW (lpString="CscService") returned 10 [0070.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0070.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0070.535] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0070.535] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0070.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0070.535] lstrlenW (lpString="DcomLaunch") returned 10 [0070.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.535] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0070.535] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0070.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0070.535] lstrlenW (lpString="Dhcp") returned 4 [0070.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0070.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0070.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0070.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0070.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0070.536] lstrlenW (lpString="Dnscache") returned 8 [0070.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0070.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0070.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0070.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0070.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0070.536] lstrlenW (lpString="DPS") returned 3 [0070.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0070.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0070.536] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0070.536] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0070.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0070.536] lstrlenW (lpString="eventlog") returned 8 [0070.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0070.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0070.536] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0070.536] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0070.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0070.536] lstrlenW (lpString="EventSystem") returned 11 [0070.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0070.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0070.537] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0070.537] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0070.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0070.537] lstrlenW (lpString="gpsvc") returned 5 [0070.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0070.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0070.537] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0070.537] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0070.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0070.537] lstrlenW (lpString="iphlpsvc") returned 8 [0070.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.537] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0070.537] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0070.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0070.537] lstrlenW (lpString="LanmanServer") returned 12 [0070.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0070.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0070.537] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0070.537] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0070.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0070.538] lstrlenW (lpString="LanmanWorkstation") returned 17 [0070.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.538] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0070.538] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0070.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0070.538] lstrlenW (lpString="lmhosts") returned 7 [0070.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0070.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0070.538] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0070.538] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0070.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0070.538] lstrlenW (lpString="MMCSS") returned 5 [0070.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0070.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0070.538] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0070.538] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0070.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0070.538] lstrlenW (lpString="MpsSvc") returned 6 [0070.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0070.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0070.538] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0070.538] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0070.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0070.538] lstrlenW (lpString="Netman") returned 6 [0070.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0070.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0070.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0070.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0070.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0070.539] lstrlenW (lpString="netprofm") returned 8 [0070.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0070.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0070.539] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0070.539] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0070.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0070.539] lstrlenW (lpString="NlaSvc") returned 6 [0070.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0070.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0070.539] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0070.539] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0070.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0070.539] lstrlenW (lpString="nsi") returned 3 [0070.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0070.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0070.539] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0070.539] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0070.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0070.539] lstrlenW (lpString="PcaSvc") returned 6 [0070.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0070.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0070.539] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0070.539] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0070.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0070.539] lstrlenW (lpString="PlugPlay") returned 8 [0070.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0070.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0070.539] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0070.540] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0070.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0070.540] lstrlenW (lpString="Power") returned 5 [0070.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0070.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0070.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0070.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0070.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0070.540] lstrlenW (lpString="ProfSvc") returned 7 [0070.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0070.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0070.540] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0070.540] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0070.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0070.540] lstrlenW (lpString="RpcEptMapper") returned 12 [0070.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.540] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0070.540] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0070.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0070.540] lstrlenW (lpString="RpcSs") returned 5 [0070.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0070.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0070.540] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0070.540] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0070.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0070.540] lstrlenW (lpString="SamSs") returned 5 [0070.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0070.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0070.541] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0070.541] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0070.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0070.541] lstrlenW (lpString="Schedule") returned 8 [0070.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0070.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0070.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0070.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0070.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0070.541] lstrlenW (lpString="SENS") returned 4 [0070.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0070.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0070.541] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0070.541] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0070.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0070.541] lstrlenW (lpString="ShellHWDetection") returned 16 [0070.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.541] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0070.541] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0070.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0070.541] lstrlenW (lpString="Spooler") returned 7 [0070.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0070.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0070.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0070.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0070.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0070.542] lstrlenW (lpString="swprv") returned 5 [0070.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0070.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0070.542] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0070.542] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0070.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0070.542] lstrlenW (lpString="SysMain") returned 7 [0070.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0070.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0070.542] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0070.542] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0070.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0070.542] lstrlenW (lpString="Themes") returned 6 [0070.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0070.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0070.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0070.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0070.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0070.542] lstrlenW (lpString="TrkWks") returned 6 [0070.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0070.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0070.542] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0070.542] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0070.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0070.543] lstrlenW (lpString="UxSms") returned 5 [0070.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0070.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0070.543] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0070.543] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0070.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0070.543] lstrlenW (lpString="VSS") returned 3 [0070.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0070.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0070.543] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0070.543] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0070.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0070.543] lstrlenW (lpString="WdiServiceHost") returned 14 [0070.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.543] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0070.543] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0070.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0070.543] lstrlenW (lpString="WdiSystemHost") returned 13 [0070.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.543] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0070.543] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0070.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0070.543] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0070.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.543] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0070.544] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0070.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0070.544] lstrlenW (lpString="Winmgmt") returned 7 [0070.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0070.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0070.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0070.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0070.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0070.544] lstrlenW (lpString="WPDBusEnum") returned 10 [0070.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.544] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0070.544] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0070.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0070.544] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f20078 | out: hHeap=0x5e0000) returned 1 [0070.544] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0070.546] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.547] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.548] lstrlenW (lpString="System") returned 6 [0070.548] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0070.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0070.548] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0070.548] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0070.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0070.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0070.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0070.548] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.549] lstrlenW (lpString="smss.exe") returned 8 [0070.549] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0070.549] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0070.549] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0070.549] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0070.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0070.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0070.549] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0070.549] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.549] lstrlenW (lpString="csrss.exe") returned 9 [0070.550] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0070.550] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0070.550] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0070.550] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0070.550] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0070.550] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0070.550] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0070.550] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.550] lstrlenW (lpString="wininit.exe") returned 11 [0070.550] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0070.550] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0070.551] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0070.551] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.551] lstrlenW (lpString="csrss.exe") returned 9 [0070.551] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.552] lstrlenW (lpString="winlogon.exe") returned 12 [0070.552] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.553] lstrlenW (lpString="services.exe") returned 12 [0070.553] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.553] lstrlenW (lpString="lsass.exe") returned 9 [0070.553] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.554] lstrlenW (lpString="lsm.exe") returned 7 [0070.554] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.555] lstrlenW (lpString="svchost.exe") returned 11 [0070.555] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.555] lstrlenW (lpString="svchost.exe") returned 11 [0070.555] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.556] lstrlenW (lpString="svchost.exe") returned 11 [0070.556] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.557] lstrlenW (lpString="svchost.exe") returned 11 [0070.557] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.558] lstrlenW (lpString="svchost.exe") returned 11 [0070.558] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.558] lstrlenW (lpString="audiodg.exe") returned 11 [0070.558] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.559] lstrlenW (lpString="svchost.exe") returned 11 [0070.559] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.560] lstrlenW (lpString="svchost.exe") returned 11 [0070.560] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.560] lstrlenW (lpString="dwm.exe") returned 7 [0070.560] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.561] lstrlenW (lpString="explorer.exe") returned 12 [0070.561] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.562] lstrlenW (lpString="spoolsv.exe") returned 11 [0070.562] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.562] lstrlenW (lpString="taskhost.exe") returned 12 [0070.562] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.563] lstrlenW (lpString="svchost.exe") returned 11 [0070.563] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.564] lstrlenW (lpString="taskeng.exe") returned 11 [0070.564] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.564] lstrlenW (lpString="taskhost.exe") returned 12 [0070.564] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0070.565] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0070.565] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0070.566] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0070.566] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0070.566] lstrlenW (lpString="rides.exe") returned 9 [0070.566] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0070.567] lstrlenW (lpString="logos.exe") returned 9 [0070.567] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0070.568] lstrlenW (lpString="blades.exe") returned 10 [0070.568] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0070.568] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0070.568] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0070.569] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0070.569] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0070.570] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0070.570] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0070.674] lstrlenW (lpString="zealand.exe") returned 11 [0070.674] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0070.674] lstrlenW (lpString="donate.exe") returned 10 [0070.674] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0070.675] lstrlenW (lpString="release_county.exe") returned 18 [0070.675] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0070.675] lstrlenW (lpString="merit.exe") returned 9 [0070.675] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0070.676] lstrlenW (lpString="controversial.exe") returned 17 [0070.676] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0070.676] lstrlenW (lpString="likelihood.exe") returned 14 [0070.676] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0070.677] lstrlenW (lpString="rugby bean.exe") returned 14 [0070.677] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0070.677] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0070.677] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0070.678] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0070.678] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0070.678] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0070.678] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0070.679] lstrlenW (lpString="frankfurt.exe") returned 13 [0070.679] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0070.680] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0070.680] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0070.680] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0070.680] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.681] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.681] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0070.681] lstrlenW (lpString="svhost.exe") returned 10 [0070.681] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.682] lstrlenW (lpString="cmd.exe") returned 7 [0070.682] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.682] lstrlenW (lpString="conhost.exe") returned 11 [0070.683] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0070.683] lstrlenW (lpString="vssadmin.exe") returned 12 [0070.683] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0070.684] lstrlenW (lpString="VSSVC.exe") returned 9 [0070.684] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.684] lstrlenW (lpString="svchost.exe") returned 11 [0070.684] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0070.685] CloseHandle (hObject=0x1c4) returned 1 [0070.685] Sleep (dwMilliseconds=0x1f4) [0071.207] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660508 [0071.207] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0071.208] GetLastError () returned 0xea [0071.208] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12c6) returned 0x3f10070 [0071.208] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f10070, cbBufSize=0x12c6, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f10070, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0071.208] CloseServiceHandle (hSCObject=0x660508) returned 1 [0071.208] lstrlenW (lpString="Appinfo") returned 7 [0071.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0071.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0071.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0071.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0071.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0071.208] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0071.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0071.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0071.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0071.208] lstrlenW (lpString="AudioSrv") returned 8 [0071.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0071.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0071.209] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0071.209] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0071.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0071.209] lstrlenW (lpString="BFE") returned 3 [0071.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0071.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0071.209] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0071.209] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0071.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0071.209] lstrlenW (lpString="CryptSvc") returned 8 [0071.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0071.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0071.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0071.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0071.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0071.209] lstrlenW (lpString="CscService") returned 10 [0071.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0071.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0071.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0071.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0071.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0071.209] lstrlenW (lpString="DcomLaunch") returned 10 [0071.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0071.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0071.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0071.209] lstrlenW (lpString="Dhcp") returned 4 [0071.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0071.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0071.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0071.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0071.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0071.209] lstrlenW (lpString="Dnscache") returned 8 [0071.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0071.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0071.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0071.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0071.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0071.209] lstrlenW (lpString="DPS") returned 3 [0071.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0071.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0071.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0071.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0071.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0071.210] lstrlenW (lpString="eventlog") returned 8 [0071.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0071.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0071.210] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0071.210] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0071.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0071.210] lstrlenW (lpString="EventSystem") returned 11 [0071.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0071.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0071.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0071.210] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0071.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0071.210] lstrlenW (lpString="gpsvc") returned 5 [0071.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0071.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0071.210] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0071.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0071.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0071.210] lstrlenW (lpString="iphlpsvc") returned 8 [0071.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.210] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0071.210] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0071.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0071.210] lstrlenW (lpString="LanmanServer") returned 12 [0071.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0071.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0071.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0071.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0071.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0071.210] lstrlenW (lpString="LanmanWorkstation") returned 17 [0071.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0071.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0071.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0071.211] lstrlenW (lpString="lmhosts") returned 7 [0071.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0071.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0071.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0071.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0071.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0071.211] lstrlenW (lpString="MMCSS") returned 5 [0071.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0071.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0071.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0071.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0071.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0071.211] lstrlenW (lpString="MpsSvc") returned 6 [0071.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0071.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0071.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0071.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0071.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0071.211] lstrlenW (lpString="Netman") returned 6 [0071.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0071.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0071.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0071.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0071.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0071.211] lstrlenW (lpString="netprofm") returned 8 [0071.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0071.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0071.211] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0071.211] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0071.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0071.211] lstrlenW (lpString="NlaSvc") returned 6 [0071.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0071.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0071.211] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0071.211] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0071.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0071.212] lstrlenW (lpString="nsi") returned 3 [0071.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0071.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0071.212] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0071.212] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0071.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0071.212] lstrlenW (lpString="PcaSvc") returned 6 [0071.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0071.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0071.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0071.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0071.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0071.212] lstrlenW (lpString="PlugPlay") returned 8 [0071.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0071.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0071.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0071.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0071.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0071.212] lstrlenW (lpString="Power") returned 5 [0071.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0071.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0071.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0071.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0071.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0071.212] lstrlenW (lpString="ProfSvc") returned 7 [0071.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0071.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0071.212] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0071.212] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0071.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0071.212] lstrlenW (lpString="RpcEptMapper") returned 12 [0071.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.212] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0071.212] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0071.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0071.212] lstrlenW (lpString="RpcSs") returned 5 [0071.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0071.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0071.212] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0071.212] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0071.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0071.213] lstrlenW (lpString="SamSs") returned 5 [0071.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0071.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0071.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0071.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0071.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0071.213] lstrlenW (lpString="Schedule") returned 8 [0071.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0071.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0071.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0071.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0071.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0071.213] lstrlenW (lpString="SENS") returned 4 [0071.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0071.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0071.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0071.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0071.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0071.213] lstrlenW (lpString="ShellHWDetection") returned 16 [0071.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0071.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0071.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0071.213] lstrlenW (lpString="Spooler") returned 7 [0071.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0071.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0071.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0071.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0071.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0071.213] lstrlenW (lpString="swprv") returned 5 [0071.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0071.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0071.213] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0071.213] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0071.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0071.213] lstrlenW (lpString="SysMain") returned 7 [0071.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0071.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0071.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0071.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0071.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0071.214] lstrlenW (lpString="Themes") returned 6 [0071.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0071.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0071.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0071.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0071.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0071.214] lstrlenW (lpString="TrkWks") returned 6 [0071.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0071.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0071.214] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0071.214] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0071.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0071.214] lstrlenW (lpString="UxSms") returned 5 [0071.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0071.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0071.214] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0071.214] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0071.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0071.214] lstrlenW (lpString="VSS") returned 3 [0071.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0071.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0071.214] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0071.214] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0071.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0071.214] lstrlenW (lpString="WdiServiceHost") returned 14 [0071.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.214] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0071.214] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0071.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0071.214] lstrlenW (lpString="WdiSystemHost") returned 13 [0071.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.214] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0071.214] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0071.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0071.214] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0071.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.214] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0071.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0071.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0071.215] lstrlenW (lpString="Winmgmt") returned 7 [0071.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0071.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0071.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0071.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0071.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0071.215] lstrlenW (lpString="WPDBusEnum") returned 10 [0071.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0071.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0071.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0071.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0071.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0071.215] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f10070 | out: hHeap=0x5e0000) returned 1 [0071.217] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0071.222] Process32FirstW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.223] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.223] lstrlenW (lpString="System") returned 6 [0071.223] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0071.223] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0071.223] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0071.224] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0071.224] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0071.224] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0071.224] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0071.224] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.224] lstrlenW (lpString="smss.exe") returned 8 [0071.224] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0071.224] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0071.224] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0071.224] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0071.224] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0071.224] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0071.224] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0071.224] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.225] lstrlenW (lpString="csrss.exe") returned 9 [0071.225] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0071.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0071.225] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0071.225] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0071.225] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0071.225] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0071.225] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0071.225] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.225] lstrlenW (lpString="wininit.exe") returned 11 [0071.225] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0071.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0071.225] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0071.226] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.226] lstrlenW (lpString="csrss.exe") returned 9 [0071.226] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.227] lstrlenW (lpString="winlogon.exe") returned 12 [0071.227] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.227] lstrlenW (lpString="services.exe") returned 12 [0071.227] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.228] lstrlenW (lpString="lsass.exe") returned 9 [0071.228] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0071.228] lstrlenW (lpString="lsm.exe") returned 7 [0071.228] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.229] lstrlenW (lpString="svchost.exe") returned 11 [0071.229] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.229] lstrlenW (lpString="svchost.exe") returned 11 [0071.229] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.230] lstrlenW (lpString="svchost.exe") returned 11 [0071.230] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.230] lstrlenW (lpString="svchost.exe") returned 11 [0071.230] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.231] lstrlenW (lpString="svchost.exe") returned 11 [0071.231] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.231] lstrlenW (lpString="audiodg.exe") returned 11 [0071.231] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.232] lstrlenW (lpString="svchost.exe") returned 11 [0071.232] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.232] lstrlenW (lpString="svchost.exe") returned 11 [0071.232] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.233] lstrlenW (lpString="dwm.exe") returned 7 [0071.233] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.233] lstrlenW (lpString="explorer.exe") returned 12 [0071.233] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.234] lstrlenW (lpString="spoolsv.exe") returned 11 [0071.234] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.234] lstrlenW (lpString="taskhost.exe") returned 12 [0071.234] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.235] lstrlenW (lpString="svchost.exe") returned 11 [0071.235] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0071.235] lstrlenW (lpString="taskeng.exe") returned 11 [0071.235] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.236] lstrlenW (lpString="taskhost.exe") returned 12 [0071.236] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0071.236] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0071.236] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0071.237] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0071.237] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0071.237] lstrlenW (lpString="rides.exe") returned 9 [0071.237] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0071.238] lstrlenW (lpString="logos.exe") returned 9 [0071.238] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0071.238] lstrlenW (lpString="blades.exe") returned 10 [0071.238] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0071.239] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0071.239] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0071.239] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0071.240] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0071.240] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0071.240] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0071.241] lstrlenW (lpString="zealand.exe") returned 11 [0071.241] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0071.241] lstrlenW (lpString="donate.exe") returned 10 [0071.241] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0071.242] lstrlenW (lpString="release_county.exe") returned 18 [0071.242] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0071.242] lstrlenW (lpString="merit.exe") returned 9 [0071.242] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0071.243] lstrlenW (lpString="controversial.exe") returned 17 [0071.243] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0071.243] lstrlenW (lpString="likelihood.exe") returned 14 [0071.243] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0071.244] lstrlenW (lpString="rugby bean.exe") returned 14 [0071.244] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0071.250] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0071.250] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0071.251] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0071.251] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0071.251] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0071.252] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0071.252] lstrlenW (lpString="frankfurt.exe") returned 13 [0071.252] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0071.253] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0071.253] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0071.253] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0071.253] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.254] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.254] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0071.254] lstrlenW (lpString="svhost.exe") returned 10 [0071.254] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.255] lstrlenW (lpString="cmd.exe") returned 7 [0071.255] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.255] lstrlenW (lpString="conhost.exe") returned 11 [0071.255] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0071.256] lstrlenW (lpString="vssadmin.exe") returned 12 [0071.256] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0071.256] lstrlenW (lpString="VSSVC.exe") returned 9 [0071.256] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.257] lstrlenW (lpString="svchost.exe") returned 11 [0071.257] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0071.257] CloseHandle (hObject=0x214) returned 1 [0071.257] Sleep (dwMilliseconds=0x1f4) [0071.758] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660508 [0071.758] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0071.758] GetLastError () returned 0xea [0071.758] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12c6) returned 0x3f30080 [0071.759] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f30080, cbBufSize=0x12c6, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f30080, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0071.759] CloseServiceHandle (hSCObject=0x660508) returned 1 [0071.759] lstrlenW (lpString="Appinfo") returned 7 [0071.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0071.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0071.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0071.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0071.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0071.759] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0071.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.760] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0071.760] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0071.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0071.760] lstrlenW (lpString="AudioSrv") returned 8 [0071.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0071.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0071.760] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0071.760] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0071.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0071.760] lstrlenW (lpString="BFE") returned 3 [0071.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0071.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0071.760] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0071.760] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0071.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0071.760] lstrlenW (lpString="CryptSvc") returned 8 [0071.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0071.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0071.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0071.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0071.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0071.760] lstrlenW (lpString="CscService") returned 10 [0071.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0071.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0071.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0071.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0071.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0071.760] lstrlenW (lpString="DcomLaunch") returned 10 [0071.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.761] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0071.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0071.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0071.761] lstrlenW (lpString="Dhcp") returned 4 [0071.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0071.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0071.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0071.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0071.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0071.761] lstrlenW (lpString="Dnscache") returned 8 [0071.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0071.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0071.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0071.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0071.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0071.761] lstrlenW (lpString="DPS") returned 3 [0071.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0071.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0071.761] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0071.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0071.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0071.761] lstrlenW (lpString="eventlog") returned 8 [0071.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0071.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0071.761] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0071.761] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0071.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0071.761] lstrlenW (lpString="EventSystem") returned 11 [0071.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0071.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0071.762] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0071.762] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0071.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0071.762] lstrlenW (lpString="gpsvc") returned 5 [0071.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0071.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0071.762] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0071.762] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0071.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0071.762] lstrlenW (lpString="iphlpsvc") returned 8 [0071.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.762] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0071.762] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0071.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0071.762] lstrlenW (lpString="LanmanServer") returned 12 [0071.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0071.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0071.762] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0071.762] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0071.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0071.762] lstrlenW (lpString="LanmanWorkstation") returned 17 [0071.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.762] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0071.762] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0071.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0071.762] lstrlenW (lpString="lmhosts") returned 7 [0071.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0071.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0071.763] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0071.763] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0071.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0071.763] lstrlenW (lpString="MMCSS") returned 5 [0071.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0071.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0071.763] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0071.763] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0071.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0071.763] lstrlenW (lpString="MpsSvc") returned 6 [0071.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0071.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0071.763] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0071.763] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0071.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0071.763] lstrlenW (lpString="Netman") returned 6 [0071.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0071.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0071.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0071.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0071.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0071.763] lstrlenW (lpString="netprofm") returned 8 [0071.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0071.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0071.763] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0071.763] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0071.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0071.763] lstrlenW (lpString="NlaSvc") returned 6 [0071.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0071.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0071.764] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0071.764] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0071.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0071.764] lstrlenW (lpString="nsi") returned 3 [0071.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0071.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0071.764] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0071.764] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0071.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0071.764] lstrlenW (lpString="PcaSvc") returned 6 [0071.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0071.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0071.764] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0071.764] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0071.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0071.764] lstrlenW (lpString="PlugPlay") returned 8 [0071.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0071.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0071.764] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0071.764] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0071.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0071.764] lstrlenW (lpString="Power") returned 5 [0071.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0071.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0071.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0071.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0071.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0071.764] lstrlenW (lpString="ProfSvc") returned 7 [0071.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0071.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0071.765] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0071.765] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0071.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0071.765] lstrlenW (lpString="RpcEptMapper") returned 12 [0071.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.765] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0071.765] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0071.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0071.765] lstrlenW (lpString="RpcSs") returned 5 [0071.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0071.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0071.765] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0071.765] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0071.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0071.765] lstrlenW (lpString="SamSs") returned 5 [0071.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0071.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0071.765] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0071.765] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0071.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0071.765] lstrlenW (lpString="Schedule") returned 8 [0071.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0071.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0071.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0071.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0071.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0071.765] lstrlenW (lpString="SENS") returned 4 [0071.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0071.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0071.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0071.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0071.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0071.766] lstrlenW (lpString="ShellHWDetection") returned 16 [0071.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.766] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0071.766] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0071.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0071.766] lstrlenW (lpString="Spooler") returned 7 [0071.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0071.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0071.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0071.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0071.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0071.766] lstrlenW (lpString="swprv") returned 5 [0071.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0071.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0071.766] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0071.766] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0071.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0071.766] lstrlenW (lpString="SysMain") returned 7 [0071.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0071.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0071.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0071.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0071.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0071.766] lstrlenW (lpString="Themes") returned 6 [0071.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0071.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0071.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0071.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0071.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0071.767] lstrlenW (lpString="TrkWks") returned 6 [0071.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0071.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0071.767] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0071.767] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0071.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0071.767] lstrlenW (lpString="UxSms") returned 5 [0071.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0071.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0071.767] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0071.767] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0071.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0071.767] lstrlenW (lpString="VSS") returned 3 [0071.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0071.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0071.767] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0071.767] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0071.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0071.767] lstrlenW (lpString="WdiServiceHost") returned 14 [0071.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.767] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0071.767] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0071.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0071.767] lstrlenW (lpString="WdiSystemHost") returned 13 [0071.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.767] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0071.767] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0071.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0071.768] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0071.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.768] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0071.768] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0071.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0071.768] lstrlenW (lpString="Winmgmt") returned 7 [0071.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0071.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0071.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0071.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0071.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0071.768] lstrlenW (lpString="WPDBusEnum") returned 10 [0071.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0071.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0071.768] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0071.768] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0071.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0071.768] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f30080 | out: hHeap=0x5e0000) returned 1 [0071.768] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0071.770] Process32FirstW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.908] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.137] lstrlenW (lpString="System") returned 6 [0072.137] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0072.137] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0072.137] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0072.137] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0072.137] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0072.137] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0072.137] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0072.137] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.138] lstrlenW (lpString="smss.exe") returned 8 [0072.138] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0072.138] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0072.138] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0072.138] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0072.138] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0072.138] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0072.138] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0072.138] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.139] lstrlenW (lpString="csrss.exe") returned 9 [0072.139] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0072.139] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0072.139] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0072.139] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0072.139] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0072.139] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0072.139] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0072.139] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.139] lstrlenW (lpString="wininit.exe") returned 11 [0072.139] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0072.139] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0072.139] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0072.139] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.140] lstrlenW (lpString="csrss.exe") returned 9 [0072.140] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.140] lstrlenW (lpString="winlogon.exe") returned 12 [0072.141] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.141] lstrlenW (lpString="services.exe") returned 12 [0072.141] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.142] lstrlenW (lpString="lsass.exe") returned 9 [0072.142] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.142] lstrlenW (lpString="lsm.exe") returned 7 [0072.142] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.143] lstrlenW (lpString="svchost.exe") returned 11 [0072.143] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.143] lstrlenW (lpString="svchost.exe") returned 11 [0072.143] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.144] lstrlenW (lpString="svchost.exe") returned 11 [0072.144] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.144] lstrlenW (lpString="svchost.exe") returned 11 [0072.144] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.145] lstrlenW (lpString="svchost.exe") returned 11 [0072.145] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.145] lstrlenW (lpString="audiodg.exe") returned 11 [0072.145] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.146] lstrlenW (lpString="svchost.exe") returned 11 [0072.146] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.146] lstrlenW (lpString="svchost.exe") returned 11 [0072.147] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.147] lstrlenW (lpString="dwm.exe") returned 7 [0072.147] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.148] lstrlenW (lpString="explorer.exe") returned 12 [0072.148] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.148] lstrlenW (lpString="spoolsv.exe") returned 11 [0072.148] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.149] lstrlenW (lpString="taskhost.exe") returned 12 [0072.149] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.149] lstrlenW (lpString="svchost.exe") returned 11 [0072.149] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.150] lstrlenW (lpString="taskeng.exe") returned 11 [0072.150] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.150] lstrlenW (lpString="taskhost.exe") returned 12 [0072.150] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0072.151] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0072.151] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0072.151] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0072.151] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0072.152] lstrlenW (lpString="rides.exe") returned 9 [0072.152] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0072.153] lstrlenW (lpString="logos.exe") returned 9 [0072.153] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0072.153] lstrlenW (lpString="blades.exe") returned 10 [0072.153] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0072.154] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0072.154] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0072.154] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0072.154] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0072.155] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0072.155] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0072.156] lstrlenW (lpString="zealand.exe") returned 11 [0072.156] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0072.156] lstrlenW (lpString="donate.exe") returned 10 [0072.156] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0072.157] lstrlenW (lpString="release_county.exe") returned 18 [0072.157] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0072.157] lstrlenW (lpString="merit.exe") returned 9 [0072.157] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0072.158] lstrlenW (lpString="controversial.exe") returned 17 [0072.158] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0072.158] lstrlenW (lpString="likelihood.exe") returned 14 [0072.158] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0072.159] lstrlenW (lpString="rugby bean.exe") returned 14 [0072.159] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0072.160] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0072.160] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0072.160] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0072.160] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0072.161] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0072.161] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0072.161] lstrlenW (lpString="frankfurt.exe") returned 13 [0072.161] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0072.162] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0072.162] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0072.162] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0072.162] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.163] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.163] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0072.251] lstrlenW (lpString="svhost.exe") returned 10 [0072.251] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.252] lstrlenW (lpString="cmd.exe") returned 7 [0072.252] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.252] lstrlenW (lpString="conhost.exe") returned 11 [0072.253] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0072.253] lstrlenW (lpString="vssadmin.exe") returned 12 [0072.253] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0072.254] lstrlenW (lpString="VSSVC.exe") returned 9 [0072.254] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.255] lstrlenW (lpString="svchost.exe") returned 11 [0072.255] Process32NextW (in: hSnapshot=0x218, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0072.255] CloseHandle (hObject=0x218) returned 1 [0072.255] Sleep (dwMilliseconds=0x1f4) [0072.756] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660508 [0072.756] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0072.756] GetLastError () returned 0xea [0072.757] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12c6) returned 0x3f10070 [0072.757] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f10070, cbBufSize=0x12c6, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f10070, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0072.757] CloseServiceHandle (hSCObject=0x660508) returned 1 [0072.758] lstrlenW (lpString="Appinfo") returned 7 [0072.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0072.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0072.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0072.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0072.758] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0072.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.758] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0072.758] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0072.758] lstrlenW (lpString="AudioSrv") returned 8 [0072.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0072.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0072.758] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0072.758] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0072.758] lstrlenW (lpString="BFE") returned 3 [0072.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0072.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0072.758] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0072.758] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0072.758] lstrlenW (lpString="CryptSvc") returned 8 [0072.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0072.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0072.758] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0072.758] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0072.759] lstrlenW (lpString="CscService") returned 10 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0072.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0072.759] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0072.759] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0072.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0072.759] lstrlenW (lpString="DcomLaunch") returned 10 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.759] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0072.759] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0072.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0072.759] lstrlenW (lpString="Dhcp") returned 4 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0072.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0072.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0072.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0072.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0072.759] lstrlenW (lpString="Dnscache") returned 8 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0072.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0072.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0072.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0072.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0072.759] lstrlenW (lpString="DPS") returned 3 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0072.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0072.759] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0072.759] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0072.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0072.759] lstrlenW (lpString="eventlog") returned 8 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0072.760] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0072.760] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0072.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0072.760] lstrlenW (lpString="EventSystem") returned 11 [0072.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0072.760] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0072.760] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0072.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0072.760] lstrlenW (lpString="gpsvc") returned 5 [0072.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0072.760] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0072.760] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0072.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0072.760] lstrlenW (lpString="iphlpsvc") returned 8 [0072.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.760] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0072.760] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0072.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0072.760] lstrlenW (lpString="LanmanServer") returned 12 [0072.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0072.760] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0072.760] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0072.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0072.760] lstrlenW (lpString="LanmanWorkstation") returned 17 [0072.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.760] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0072.761] lstrlenW (lpString="lmhosts") returned 7 [0072.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0072.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0072.761] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0072.761] lstrlenW (lpString="MMCSS") returned 5 [0072.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0072.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0072.761] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0072.761] lstrlenW (lpString="MpsSvc") returned 6 [0072.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0072.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0072.761] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0072.761] lstrlenW (lpString="Netman") returned 6 [0072.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0072.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0072.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0072.761] lstrlenW (lpString="netprofm") returned 8 [0072.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0072.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0072.761] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0072.762] lstrlenW (lpString="NlaSvc") returned 6 [0072.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0072.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0072.762] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0072.762] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0072.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0072.762] lstrlenW (lpString="nsi") returned 3 [0072.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0072.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0072.762] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0072.762] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0072.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0072.762] lstrlenW (lpString="PcaSvc") returned 6 [0072.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0072.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0072.762] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0072.762] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0072.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0072.762] lstrlenW (lpString="PlugPlay") returned 8 [0072.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0072.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0072.762] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0072.762] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0072.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0072.762] lstrlenW (lpString="Power") returned 5 [0072.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0072.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0072.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0072.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0072.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0072.762] lstrlenW (lpString="ProfSvc") returned 7 [0072.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0072.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0072.763] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0072.763] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0072.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0072.763] lstrlenW (lpString="RpcEptMapper") returned 12 [0072.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.763] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0072.763] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0072.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0072.763] lstrlenW (lpString="RpcSs") returned 5 [0072.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0072.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0072.763] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0072.763] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0072.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0072.763] lstrlenW (lpString="SamSs") returned 5 [0072.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0072.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0072.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0072.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0072.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0072.763] lstrlenW (lpString="Schedule") returned 8 [0072.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0072.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0072.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0072.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0072.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0072.763] lstrlenW (lpString="SENS") returned 4 [0072.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0072.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0072.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0072.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0072.764] lstrlenW (lpString="ShellHWDetection") returned 16 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0072.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0072.764] lstrlenW (lpString="Spooler") returned 7 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0072.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0072.764] lstrlenW (lpString="swprv") returned 5 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0072.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0072.764] lstrlenW (lpString="SysMain") returned 7 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0072.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0072.764] lstrlenW (lpString="Themes") returned 6 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0072.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0072.764] lstrlenW (lpString="TrkWks") returned 6 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0072.765] lstrlenW (lpString="UxSms") returned 5 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0072.765] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0072.765] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0072.765] lstrlenW (lpString="VSS") returned 3 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0072.765] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0072.765] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0072.765] lstrlenW (lpString="WdiServiceHost") returned 14 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0072.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0072.765] lstrlenW (lpString="WdiSystemHost") returned 13 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0072.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0072.765] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0072.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0072.765] lstrlenW (lpString="Winmgmt") returned 7 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0072.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0072.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0072.765] lstrlenW (lpString="WPDBusEnum") returned 10 [0072.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0072.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0072.766] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0072.766] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0072.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0072.766] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f10070 | out: hHeap=0x5e0000) returned 1 [0072.768] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0072.769] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.770] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.770] lstrlenW (lpString="System") returned 6 [0072.770] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0072.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0072.770] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0072.770] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0072.770] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0072.770] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0072.770] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0072.770] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.771] lstrlenW (lpString="smss.exe") returned 8 [0072.771] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0072.771] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0072.771] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0072.771] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0072.771] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0072.771] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0072.771] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0072.771] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.772] lstrlenW (lpString="csrss.exe") returned 9 [0072.772] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0072.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0072.772] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0072.772] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0072.772] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0072.772] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0072.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0072.772] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.772] lstrlenW (lpString="wininit.exe") returned 11 [0072.772] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0072.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0072.773] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0072.773] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.773] lstrlenW (lpString="csrss.exe") returned 9 [0072.773] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.774] lstrlenW (lpString="winlogon.exe") returned 12 [0072.774] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.774] lstrlenW (lpString="services.exe") returned 12 [0072.774] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.775] lstrlenW (lpString="lsass.exe") returned 9 [0072.775] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.775] lstrlenW (lpString="lsm.exe") returned 7 [0072.775] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.776] lstrlenW (lpString="svchost.exe") returned 11 [0072.776] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.776] lstrlenW (lpString="svchost.exe") returned 11 [0072.776] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.777] lstrlenW (lpString="svchost.exe") returned 11 [0072.777] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.777] lstrlenW (lpString="svchost.exe") returned 11 [0072.777] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.778] lstrlenW (lpString="svchost.exe") returned 11 [0072.778] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.778] lstrlenW (lpString="audiodg.exe") returned 11 [0072.778] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.779] lstrlenW (lpString="svchost.exe") returned 11 [0072.779] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.780] lstrlenW (lpString="svchost.exe") returned 11 [0072.780] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.780] lstrlenW (lpString="dwm.exe") returned 7 [0072.780] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.781] lstrlenW (lpString="explorer.exe") returned 12 [0072.781] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.782] lstrlenW (lpString="spoolsv.exe") returned 11 [0072.782] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.782] lstrlenW (lpString="taskhost.exe") returned 12 [0072.782] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.783] lstrlenW (lpString="svchost.exe") returned 11 [0072.783] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.784] lstrlenW (lpString="taskeng.exe") returned 11 [0072.784] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.784] lstrlenW (lpString="taskhost.exe") returned 12 [0072.784] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0072.785] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0072.785] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0072.786] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0072.786] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0072.786] lstrlenW (lpString="rides.exe") returned 9 [0072.786] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0072.787] lstrlenW (lpString="logos.exe") returned 9 [0072.787] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0072.787] lstrlenW (lpString="blades.exe") returned 10 [0072.787] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0072.788] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0072.788] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0072.788] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0072.789] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0072.789] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0072.789] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0072.790] lstrlenW (lpString="zealand.exe") returned 11 [0072.790] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0072.790] lstrlenW (lpString="donate.exe") returned 10 [0072.790] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0072.791] lstrlenW (lpString="release_county.exe") returned 18 [0072.791] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0072.791] lstrlenW (lpString="merit.exe") returned 9 [0072.792] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0072.792] lstrlenW (lpString="controversial.exe") returned 17 [0072.792] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0072.793] lstrlenW (lpString="likelihood.exe") returned 14 [0072.793] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0072.793] lstrlenW (lpString="rugby bean.exe") returned 14 [0072.793] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0072.794] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0072.794] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0072.794] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0072.794] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0072.795] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0072.795] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0072.795] lstrlenW (lpString="frankfurt.exe") returned 13 [0072.795] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0072.796] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0072.796] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0072.796] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0072.796] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.797] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.797] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0072.797] lstrlenW (lpString="svhost.exe") returned 10 [0072.797] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.798] lstrlenW (lpString="cmd.exe") returned 7 [0072.798] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.798] lstrlenW (lpString="conhost.exe") returned 11 [0072.798] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0072.799] lstrlenW (lpString="vssadmin.exe") returned 12 [0072.799] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0072.799] lstrlenW (lpString="VSSVC.exe") returned 9 [0072.799] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.800] lstrlenW (lpString="svchost.exe") returned 11 [0072.800] Process32NextW (in: hSnapshot=0x1c4, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0072.800] CloseHandle (hObject=0x1c4) returned 1 [0072.800] Sleep (dwMilliseconds=0x1f4) [0073.588] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x660508 [0073.589] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 0 [0073.589] GetLastError () returned 0xea [0073.589] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x12c6) returned 0x3f10070 [0073.589] EnumServicesStatusExW (in: hSCManager=0x660508, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f10070, cbBufSize=0x12c6, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f10070, pcbBytesNeeded=0x213ff44, lpServicesReturned=0x213ff5c, lpResumeHandle=0x0) returned 1 [0073.590] CloseServiceHandle (hSCObject=0x660508) returned 1 [0073.590] lstrlenW (lpString="Appinfo") returned 7 [0073.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0073.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0073.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0073.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0073.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0073.590] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0073.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.590] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0073.590] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0073.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0073.590] lstrlenW (lpString="AudioSrv") returned 8 [0073.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0073.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0073.590] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0073.590] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0073.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0073.590] lstrlenW (lpString="BFE") returned 3 [0073.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0073.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0073.590] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0073.590] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0073.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0073.591] lstrlenW (lpString="CryptSvc") returned 8 [0073.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0073.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0073.591] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0073.591] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0073.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0073.591] lstrlenW (lpString="CscService") returned 10 [0073.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0073.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0073.591] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0073.591] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0073.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0073.591] lstrlenW (lpString="DcomLaunch") returned 10 [0073.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0073.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0073.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0073.591] lstrlenW (lpString="Dhcp") returned 4 [0073.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0073.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0073.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0073.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0073.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0073.591] lstrlenW (lpString="Dnscache") returned 8 [0073.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0073.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0073.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0073.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0073.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0073.591] lstrlenW (lpString="DPS") returned 3 [0073.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0073.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0073.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0073.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0073.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0073.591] lstrlenW (lpString="eventlog") returned 8 [0073.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0073.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0073.592] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0073.592] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0073.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0073.592] lstrlenW (lpString="EventSystem") returned 11 [0073.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0073.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0073.592] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0073.592] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0073.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0073.592] lstrlenW (lpString="gpsvc") returned 5 [0073.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0073.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0073.592] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0073.592] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0073.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0073.592] lstrlenW (lpString="iphlpsvc") returned 8 [0073.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.592] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0073.592] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0073.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0073.592] lstrlenW (lpString="LanmanServer") returned 12 [0073.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0073.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0073.592] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0073.592] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0073.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0073.592] lstrlenW (lpString="LanmanWorkstation") returned 17 [0073.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.592] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0073.592] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0073.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0073.592] lstrlenW (lpString="lmhosts") returned 7 [0073.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0073.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0073.592] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0073.593] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0073.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0073.593] lstrlenW (lpString="MMCSS") returned 5 [0073.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0073.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0073.593] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0073.593] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0073.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0073.593] lstrlenW (lpString="MpsSvc") returned 6 [0073.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0073.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0073.593] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0073.593] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0073.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0073.593] lstrlenW (lpString="Netman") returned 6 [0073.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0073.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0073.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0073.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0073.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0073.593] lstrlenW (lpString="netprofm") returned 8 [0073.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0073.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0073.593] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0073.593] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0073.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0073.593] lstrlenW (lpString="NlaSvc") returned 6 [0073.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0073.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0073.593] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0073.593] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0073.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0073.593] lstrlenW (lpString="nsi") returned 3 [0073.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0073.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0073.593] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0073.594] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0073.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0073.594] lstrlenW (lpString="PcaSvc") returned 6 [0073.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0073.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0073.594] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0073.594] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0073.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0073.594] lstrlenW (lpString="PlugPlay") returned 8 [0073.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0073.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0073.594] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0073.594] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0073.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0073.594] lstrlenW (lpString="Power") returned 5 [0073.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0073.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0073.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0073.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0073.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0073.594] lstrlenW (lpString="ProfSvc") returned 7 [0073.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0073.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0073.594] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0073.594] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0073.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0073.594] lstrlenW (lpString="RpcEptMapper") returned 12 [0073.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.594] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0073.594] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0073.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0073.594] lstrlenW (lpString="RpcSs") returned 5 [0073.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0073.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0073.594] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0073.594] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0073.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0073.594] lstrlenW (lpString="SamSs") returned 5 [0073.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0073.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0073.595] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0073.595] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0073.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0073.595] lstrlenW (lpString="Schedule") returned 8 [0073.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0073.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0073.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0073.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0073.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0073.595] lstrlenW (lpString="SENS") returned 4 [0073.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0073.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0073.595] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0073.595] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0073.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0073.595] lstrlenW (lpString="ShellHWDetection") returned 16 [0073.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.595] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0073.595] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0073.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0073.595] lstrlenW (lpString="Spooler") returned 7 [0073.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0073.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0073.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0073.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0073.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0073.595] lstrlenW (lpString="swprv") returned 5 [0073.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0073.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0073.595] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0073.595] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0073.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0073.595] lstrlenW (lpString="SysMain") returned 7 [0073.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0073.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0073.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0073.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0073.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0073.596] lstrlenW (lpString="Themes") returned 6 [0073.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0073.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0073.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0073.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0073.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0073.596] lstrlenW (lpString="TrkWks") returned 6 [0073.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0073.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0073.596] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0073.596] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0073.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0073.596] lstrlenW (lpString="UxSms") returned 5 [0073.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0073.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0073.596] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0073.596] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0073.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0073.596] lstrlenW (lpString="VSS") returned 3 [0073.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0073.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0073.596] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0073.596] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0073.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0073.596] lstrlenW (lpString="WdiServiceHost") returned 14 [0073.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.596] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0073.596] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0073.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0073.596] lstrlenW (lpString="WdiSystemHost") returned 13 [0073.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.596] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0073.596] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0073.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0073.597] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0073.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.597] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0073.597] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0073.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0073.597] lstrlenW (lpString="Winmgmt") returned 7 [0073.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0073.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0073.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0073.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0073.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0073.597] lstrlenW (lpString="WPDBusEnum") returned 10 [0073.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0073.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0073.597] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0073.597] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0073.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0073.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f10070 | out: hHeap=0x5e0000) returned 1 [0073.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0073.601] Process32FirstW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.601] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.602] lstrlenW (lpString="System") returned 6 [0073.602] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0073.602] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0073.602] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0073.602] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0073.602] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0073.602] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0073.602] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0073.602] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.602] lstrlenW (lpString="smss.exe") returned 8 [0073.602] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0073.602] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0073.602] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0073.602] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0073.603] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0073.603] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0073.603] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0073.603] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.603] lstrlenW (lpString="csrss.exe") returned 9 [0073.603] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0073.603] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0073.603] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0073.603] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0073.603] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0073.603] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0073.603] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0073.603] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.604] lstrlenW (lpString="wininit.exe") returned 11 [0073.604] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0073.604] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0073.604] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0073.604] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.604] lstrlenW (lpString="csrss.exe") returned 9 [0073.605] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.605] lstrlenW (lpString="winlogon.exe") returned 12 [0073.605] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.606] lstrlenW (lpString="services.exe") returned 12 [0073.606] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.606] lstrlenW (lpString="lsass.exe") returned 9 [0073.606] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.607] lstrlenW (lpString="lsm.exe") returned 7 [0073.607] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.607] lstrlenW (lpString="svchost.exe") returned 11 [0073.607] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.608] lstrlenW (lpString="svchost.exe") returned 11 [0073.608] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.608] lstrlenW (lpString="svchost.exe") returned 11 [0073.608] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.609] lstrlenW (lpString="svchost.exe") returned 11 [0073.609] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.609] lstrlenW (lpString="svchost.exe") returned 11 [0073.609] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.610] lstrlenW (lpString="audiodg.exe") returned 11 [0073.610] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.610] lstrlenW (lpString="svchost.exe") returned 11 [0073.611] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.611] lstrlenW (lpString="svchost.exe") returned 11 [0073.611] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.612] lstrlenW (lpString="dwm.exe") returned 7 [0073.612] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.612] lstrlenW (lpString="explorer.exe") returned 12 [0073.612] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.613] lstrlenW (lpString="spoolsv.exe") returned 11 [0073.613] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.613] lstrlenW (lpString="taskhost.exe") returned 12 [0073.614] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.614] lstrlenW (lpString="svchost.exe") returned 11 [0073.614] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.615] lstrlenW (lpString="taskeng.exe") returned 11 [0073.615] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.616] lstrlenW (lpString="taskhost.exe") returned 12 [0073.616] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alleged_barry_pmc.exe")) returned 1 [0073.620] lstrlenW (lpString="alleged_barry_pmc.exe") returned 21 [0073.620] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lot-poet-gamecube.exe")) returned 1 [0073.620] lstrlenW (lpString="lot-poet-gamecube.exe") returned 21 [0073.620] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rides.exe")) returned 1 [0073.621] lstrlenW (lpString="rides.exe") returned 9 [0073.621] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="logos.exe")) returned 1 [0073.621] lstrlenW (lpString="logos.exe") returned 9 [0073.622] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blades.exe")) returned 1 [0073.622] lstrlenW (lpString="blades.exe") returned 10 [0073.622] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accreditation_threads_readers.exe")) returned 1 [0073.623] lstrlenW (lpString="accreditation_threads_readers.exe") returned 33 [0073.623] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valuable_sheriff.exe")) returned 1 [0073.623] lstrlenW (lpString="valuable_sheriff.exe") returned 20 [0073.623] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cloud_gulf.exe")) returned 1 [0073.624] lstrlenW (lpString="cloud_gulf.exe") returned 14 [0073.624] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zealand.exe")) returned 1 [0073.729] lstrlenW (lpString="zealand.exe") returned 11 [0073.729] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donate.exe")) returned 1 [0073.730] lstrlenW (lpString="donate.exe") returned 10 [0073.730] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="release_county.exe")) returned 1 [0073.731] lstrlenW (lpString="release_county.exe") returned 18 [0073.731] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1 [0073.732] lstrlenW (lpString="merit.exe") returned 9 [0073.732] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial.exe")) returned 1 [0073.732] lstrlenW (lpString="controversial.exe") returned 17 [0073.732] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="likelihood.exe")) returned 1 [0073.733] lstrlenW (lpString="likelihood.exe") returned 14 [0073.733] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rugby bean.exe")) returned 1 [0073.734] lstrlenW (lpString="rugby bean.exe") returned 14 [0073.734] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe-caroline-happens.exe")) returned 1 [0073.734] lstrlenW (lpString="recipe-caroline-happens.exe") returned 27 [0073.734] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="industries_stationery_testament.exe")) returned 1 [0073.735] lstrlenW (lpString="industries_stationery_testament.exe") returned 35 [0073.735] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="situations exceed stopping.exe")) returned 1 [0073.736] lstrlenW (lpString="situations exceed stopping.exe") returned 30 [0073.736] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurt.exe")) returned 1 [0073.737] lstrlenW (lpString="frankfurt.exe") returned 13 [0073.737] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="institutional effectiveness.exe")) returned 1 [0073.737] lstrlenW (lpString="institutional effectiveness.exe") returned 31 [0073.737] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-alternatives.exe")) returned 1 [0073.738] lstrlenW (lpString="cultures-alternatives.exe") returned 25 [0073.738] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.748] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.748] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svhost.exe")) returned 1 [0073.749] lstrlenW (lpString="svhost.exe") returned 10 [0073.749] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0073.750] lstrlenW (lpString="cmd.exe") returned 7 [0073.750] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.750] lstrlenW (lpString="conhost.exe") returned 11 [0073.751] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0073.751] lstrlenW (lpString="vssadmin.exe") returned 12 [0073.751] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0073.752] lstrlenW (lpString="VSSVC.exe") returned 9 [0073.752] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.752] lstrlenW (lpString="svchost.exe") returned 11 [0073.753] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0073.753] lstrlenW (lpString="LogonUI.exe") returned 11 [0073.753] Process32NextW (in: hSnapshot=0x214, lppe=0x213fd34 | out: lppe=0x213fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0073.754] CloseHandle (hObject=0x214) returned 1 [0073.754] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0xa34 [0049.464] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0049.464] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x614a30 | out: hHeap=0x5e0000) returned 1 Thread: id = 6 os_tid = 0xa38 [0049.465] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x614a30 [0049.465] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x614a30, Size=0x20) returned 0x615c50 [0049.465] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x615c50, Size=0x40) returned 0x616c30 [0049.465] GetLogicalDrives () returned 0x4 [0049.465] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x64e498 [0049.465] GetComputerNameW (in: lpBuffer=0x64e49c, nSize=0x237ff6c | out: lpBuffer="XDUWTFONO", nSize=0x237ff6c) returned 1 [0049.466] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1000) returned 0x65e4a0 [0049.466] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x237ff3c | out: lphEnum=0x237ff3c*=0x6161e0) returned 0x0 [0049.466] WNetEnumResourceW (in: hEnum=0x6161e0, lpcCount=0x237ff38, lpBuffer=0x65e4a0, lpBufferSize=0x237ff40 | out: lpcCount=0x237ff38, lpBuffer=0x65e4a0, lpBufferSize=0x237ff40) returned 0x103 [0049.466] WNetCloseEnum (hEnum=0x6161e0) returned 0x0 [0049.467] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x237ff3c | out: lphEnum=0x237ff3c*=0x3f33098) returned 0x0 [0054.053] WNetEnumResourceW (in: hEnum=0x3f33098, lpcCount=0x237ff38, lpBuffer=0x65e4a0, lpBufferSize=0x237ff40 | out: lpcCount=0x237ff38, lpBuffer=0x65e4a0, lpBufferSize=0x237ff40) returned 0x0 [0054.054] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1000) returned 0x39646f0 [0054.054] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x65e4a0, lphEnum=0x237ff10 | out: lphEnum=0x237ff10*=0x616360) returned 0x0 [0054.259] WNetEnumResourceW (in: hEnum=0x616360, lpcCount=0x237ff0c, lpBuffer=0x39646f0, lpBufferSize=0x237ff14 | out: lpcCount=0x237ff0c, lpBuffer=0x39646f0, lpBufferSize=0x237ff14) returned 0x103 [0054.259] WNetCloseEnum (hEnum=0x616360) returned 0x0 [0054.259] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1000) returned 0x39689e8 [0054.260] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x65e4c0, lphEnum=0x237ff10) Thread: id = 7 os_tid = 0xa3c [0050.893] GetTickCount () returned 0x1a89d [0050.893] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x62bf88 [0050.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62bf88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0050.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62bf88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0050.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62bf88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0050.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62bf88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0050.899] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630270 [0050.899] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630270, Size=0x20) returned 0x615d40 [0050.899] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630270 [0050.899] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630270, Size=0x20) returned 0x615d68 [0050.900] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0050.900] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0050.900] Wow64DisableWow64FsRedirection (in: OldValue=0x24bff84 | out: OldValue=0x24bff84*=0x0) returned 1 [0050.900] lstrlenW (lpString="kernel32.dll") returned 12 [0050.901] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615d40 | out: hHeap=0x5e0000) returned 1 [0050.901] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.901] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615d68 | out: hHeap=0x5e0000) returned 1 [0050.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x61b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0050.903] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.529] GetTickCount () returned 0x1a929 [0051.529] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.727] GetTickCount () returned 0x1a9e5 [0051.727] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.198] GetTickCount () returned 0x1aa81 [0052.198] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.362] GetTickCount () returned 0x1ab1d [0052.362] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.553] GetTickCount () returned 0x1abd8 [0052.553] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.736] GetTickCount () returned 0x1ac93 [0052.736] GetTickCount () returned 0x1ac93 [0052.736] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.047] GetTickCount () returned 0x1adcb [0053.047] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.162] GetTickCount () returned 0x1ae38 [0053.162] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.336] GetTickCount () returned 0x1aee4 [0053.336] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.552] GetTickCount () returned 0x1af61 [0053.552] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.924] GetTickCount () returned 0x1b0d7 [0053.924] GetTickCount () returned 0x1b0d7 [0053.924] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.258] GetTickCount () returned 0x1b1ff [0054.258] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.127] GetTickCount () returned 0x1b395 [0055.127] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.948] GetTickCount () returned 0x1b4dd [0055.948] GetTickCount () returned 0x1b4dd [0055.948] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.142] GetTickCount () returned 0x1b5a7 [0056.142] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.390] GetTickCount () returned 0x1b634 [0056.390] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.568] GetTickCount () returned 0x1b6b1 [0056.568] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.719] GetTickCount () returned 0x1b74d [0056.719] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.912] GetTickCount () returned 0x1b7f8 [0056.912] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.142] GetTickCount () returned 0x1b865 [0057.142] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.037] GetTickCount () returned 0x1b921 [0058.037] GetTickCount () returned 0x1b921 [0058.037] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.280] GetTickCount () returned 0x1ba1a [0058.280] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.456] GetTickCount () returned 0x1bac6 [0058.456] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.637] GetTickCount () returned 0x1bb43 [0058.637] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.732] GetTickCount () returned 0x1bbb0 [0058.732] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.841] GetTickCount () returned 0x1bc1d [0058.841] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.963] GetTickCount () returned 0x1bc8a [0058.963] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.065] GetTickCount () returned 0x1bcf7 [0059.065] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.168] GetTickCount () returned 0x1bd65 [0059.168] GetTickCount () returned 0x1bd65 [0059.168] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.336] GetTickCount () returned 0x1be01 [0059.336] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.450] GetTickCount () returned 0x1be7d [0059.450] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.635] GetTickCount () returned 0x1bf29 [0059.635] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.993] GetTickCount () returned 0x1c051 [0059.993] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.167] GetTickCount () returned 0x1c0de [0060.167] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.276] GetTickCount () returned 0x1c14b [0060.276] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.385] GetTickCount () returned 0x1c1b8 [0060.385] GetTickCount () returned 0x1c1b8 [0060.385] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.495] GetTickCount () returned 0x1c225 [0060.495] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.604] GetTickCount () returned 0x1c293 [0060.604] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.713] GetTickCount () returned 0x1c300 [0060.713] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.822] GetTickCount () returned 0x1c36d [0060.822] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.931] GetTickCount () returned 0x1c3da [0060.931] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.042] GetTickCount () returned 0x1c447 [0061.042] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.294] GetTickCount () returned 0x1c541 [0061.294] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.551] GetTickCount () returned 0x1c63b [0061.551] GetTickCount () returned 0x1c63b [0061.553] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.863] GetTickCount () returned 0x1c744 [0061.863] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.004] GetTickCount () returned 0x1c7d0 [0062.004] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.169] GetTickCount () returned 0x1c83d [0062.169] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.198] GetTickCount () returned 0x1c8ba [0066.198] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.298] GetTickCount () returned 0x1c927 [0066.298] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.407] GetTickCount () returned 0x1c995 [0066.407] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.516] GetTickCount () returned 0x1ca02 [0066.516] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.625] GetTickCount () returned 0x1ca6f [0066.625] GetTickCount () returned 0x1ca6f [0066.625] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.734] GetTickCount () returned 0x1cadc [0066.734] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.844] GetTickCount () returned 0x1cb49 [0066.844] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.953] GetTickCount () returned 0x1cbb7 [0066.953] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.062] GetTickCount () returned 0x1cc24 [0067.062] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.172] GetTickCount () returned 0x1cc91 [0067.172] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.280] GetTickCount () returned 0x1ccfe [0067.280] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.390] GetTickCount () returned 0x1cd6b [0067.390] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.522] GetTickCount () returned 0x1cde8 [0067.522] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.655] GetTickCount () returned 0x1ce75 [0067.655] GetTickCount () returned 0x1ce75 [0067.655] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.764] GetTickCount () returned 0x1cee2 [0067.764] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.873] GetTickCount () returned 0x1cf4f [0067.873] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.982] GetTickCount () returned 0x1cfbc [0067.982] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.091] GetTickCount () returned 0x1d029 [0068.092] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.201] GetTickCount () returned 0x1d097 [0068.201] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.310] GetTickCount () returned 0x1d104 [0068.310] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.419] GetTickCount () returned 0x1d171 [0068.419] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.533] GetTickCount () returned 0x1d1de [0068.533] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.638] GetTickCount () returned 0x1d24b [0068.638] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.778] GetTickCount () returned 0x1d2d8 [0068.778] GetTickCount () returned 0x1d2d8 [0068.778] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0069.660] GetTickCount () returned 0x1d44e [0069.660] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0069.854] GetTickCount () returned 0x1d519 [0069.854] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0070.050] GetTickCount () returned 0x1d5d4 [0070.050] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0070.204] GetTickCount () returned 0x1d641 [0070.204] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0070.531] GetTickCount () returned 0x1d70c [0070.531] GetTickCount () returned 0x1d70c [0070.532] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0070.700] GetTickCount () returned 0x1d7b8 [0070.700] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0070.815] GetTickCount () returned 0x1d825 [0070.815] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0071.164] GetTickCount () returned 0x1d97c [0071.164] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0071.262] GetTickCount () returned 0x1d9e9 [0071.262] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0071.368] GetTickCount () returned 0x1da57 [0071.368] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0071.477] GetTickCount () returned 0x1dac4 [0071.478] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0071.658] GetTickCount () returned 0x1db6f [0071.659] GetTickCount () returned 0x1db6f [0071.659] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0071.758] GetTickCount () returned 0x1dbdd [0071.758] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0072.176] GetTickCount () returned 0x1dd72 [0072.176] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0072.345] GetTickCount () returned 0x1de1e [0072.345] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0072.444] GetTickCount () returned 0x1de8b [0072.444] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0072.686] GetTickCount () returned 0x1df75 [0072.686] GetTickCount () returned 0x1df75 [0072.686] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0072.801] GetTickCount () returned 0x1dfe2 [0072.801] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0072.897] GetTickCount () returned 0x1e04f [0072.897] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0073.006] GetTickCount () returned 0x1e0bd [0073.006] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0073.115] GetTickCount () returned 0x1e12a [0073.115] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0073.231] GetTickCount () returned 0x1e197 [0073.231] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0073.624] GetTickCount () returned 0x1e31d [0073.624] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0073.804] GetTickCount () returned 0x1e3d8 [0073.804] GetTickCount () returned 0x1e3d8 [0073.804] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0074.139] GetTickCount () returned 0x1e520 [0074.139] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xa40 [0050.894] GetTickCount () returned 0x1a89d [0050.894] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x630fa0 [0050.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x630fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0050.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x630fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0050.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x630fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0050.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x630fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0050.901] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630270 [0050.901] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630270, Size=0x20) returned 0x615d68 [0050.901] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630270 [0050.901] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630270, Size=0x20) returned 0x615d40 [0050.902] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0050.902] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0050.902] Wow64DisableWow64FsRedirection (in: OldValue=0x25fff84 | out: OldValue=0x25fff84*=0x0) returned 1 [0050.902] lstrlenW (lpString="kernel32.dll") returned 12 [0050.902] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615d68 | out: hHeap=0x5e0000) returned 1 [0050.902] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.902] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x615d40 | out: hHeap=0x5e0000) returned 1 [0050.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x63d438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0050.903] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.529] GetTickCount () returned 0x1a929 [0051.529] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.727] GetTickCount () returned 0x1a9f4 [0051.727] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.198] GetTickCount () returned 0x1aa81 [0052.198] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.363] GetTickCount () returned 0x1ab1d [0052.363] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.553] GetTickCount () returned 0x1abd8 [0052.553] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.736] GetTickCount () returned 0x1ac93 [0052.736] GetTickCount () returned 0x1ac93 [0052.736] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.047] GetTickCount () returned 0x1adcb [0053.047] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.162] GetTickCount () returned 0x1ae38 [0053.162] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.336] GetTickCount () returned 0x1aee4 [0053.336] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.551] GetTickCount () returned 0x1af61 [0053.551] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.924] GetTickCount () returned 0x1b0d7 [0053.924] GetTickCount () returned 0x1b0d7 [0053.924] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.258] GetTickCount () returned 0x1b1ff [0054.258] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.128] GetTickCount () returned 0x1b395 [0055.128] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.949] GetTickCount () returned 0x1b4dd [0055.949] GetTickCount () returned 0x1b4dd [0055.949] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.142] GetTickCount () returned 0x1b5a7 [0056.142] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.390] GetTickCount () returned 0x1b634 [0056.390] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.568] GetTickCount () returned 0x1b6b1 [0056.568] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.719] GetTickCount () returned 0x1b74d [0056.719] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.912] GetTickCount () returned 0x1b7f8 [0056.912] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.142] GetTickCount () returned 0x1b865 [0057.142] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.037] GetTickCount () returned 0x1b921 [0058.037] GetTickCount () returned 0x1b921 [0058.037] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.280] GetTickCount () returned 0x1ba1a [0058.280] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.455] GetTickCount () returned 0x1bac6 [0058.456] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.637] GetTickCount () returned 0x1bb43 [0058.637] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.732] GetTickCount () returned 0x1bbb0 [0058.732] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.841] GetTickCount () returned 0x1bc1d [0058.841] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.963] GetTickCount () returned 0x1bc8a [0058.963] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.065] GetTickCount () returned 0x1bcf7 [0059.065] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.169] GetTickCount () returned 0x1bd65 [0059.169] GetTickCount () returned 0x1bd65 [0059.169] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.336] GetTickCount () returned 0x1be01 [0059.336] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.450] GetTickCount () returned 0x1be7d [0059.450] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.635] GetTickCount () returned 0x1bf29 [0059.635] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.993] GetTickCount () returned 0x1c051 [0059.993] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.167] GetTickCount () returned 0x1c0de [0060.167] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.276] GetTickCount () returned 0x1c14b [0060.276] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.385] GetTickCount () returned 0x1c1b8 [0060.385] GetTickCount () returned 0x1c1b8 [0060.385] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.495] GetTickCount () returned 0x1c225 [0060.495] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.604] GetTickCount () returned 0x1c293 [0060.604] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.713] GetTickCount () returned 0x1c300 [0060.713] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.822] GetTickCount () returned 0x1c36d [0060.822] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.932] GetTickCount () returned 0x1c3da [0060.932] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.042] GetTickCount () returned 0x1c447 [0061.042] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.294] GetTickCount () returned 0x1c541 [0061.294] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.553] GetTickCount () returned 0x1c63b [0061.554] GetTickCount () returned 0x1c63b [0061.554] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.863] GetTickCount () returned 0x1c744 [0061.863] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.004] GetTickCount () returned 0x1c7d0 [0062.004] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.169] GetTickCount () returned 0x1c83d [0062.169] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.197] GetTickCount () returned 0x1c8ba [0066.197] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.298] GetTickCount () returned 0x1c927 [0066.298] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.407] GetTickCount () returned 0x1c995 [0066.407] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.516] GetTickCount () returned 0x1ca02 [0066.516] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.625] GetTickCount () returned 0x1ca6f [0066.625] GetTickCount () returned 0x1ca6f [0066.625] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.735] GetTickCount () returned 0x1cadc [0066.735] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.844] GetTickCount () returned 0x1cb49 [0066.844] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.953] GetTickCount () returned 0x1cbb7 [0066.953] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.062] GetTickCount () returned 0x1cc24 [0067.062] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.172] GetTickCount () returned 0x1cc91 [0067.172] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.280] GetTickCount () returned 0x1ccfe [0067.280] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.390] GetTickCount () returned 0x1cd6b [0067.390] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.522] GetTickCount () returned 0x1cde8 [0067.522] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.655] GetTickCount () returned 0x1ce75 [0067.655] GetTickCount () returned 0x1ce75 [0067.655] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.764] GetTickCount () returned 0x1cee2 [0067.764] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.873] GetTickCount () returned 0x1cf4f [0067.873] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.982] GetTickCount () returned 0x1cfbc [0067.982] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.092] GetTickCount () returned 0x1d029 [0068.092] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.201] GetTickCount () returned 0x1d097 [0068.201] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.310] GetTickCount () returned 0x1d104 [0068.310] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.419] GetTickCount () returned 0x1d171 [0068.419] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.533] GetTickCount () returned 0x1d1de [0068.533] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.638] GetTickCount () returned 0x1d24b [0068.638] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.778] GetTickCount () returned 0x1d2d8 [0068.778] GetTickCount () returned 0x1d2d8 [0068.778] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0069.660] GetTickCount () returned 0x1d44e [0069.660] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0069.854] GetTickCount () returned 0x1d509 [0069.854] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.050] GetTickCount () returned 0x1d5d4 [0070.050] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.204] GetTickCount () returned 0x1d641 [0070.204] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.531] GetTickCount () returned 0x1d70c [0070.531] GetTickCount () returned 0x1d70c [0070.531] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.700] GetTickCount () returned 0x1d7b8 [0070.700] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.814] GetTickCount () returned 0x1d825 [0070.815] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.164] GetTickCount () returned 0x1d97c [0071.164] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.262] GetTickCount () returned 0x1d9e9 [0071.262] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.368] GetTickCount () returned 0x1da57 [0071.368] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.478] GetTickCount () returned 0x1dac4 [0071.478] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.659] GetTickCount () returned 0x1db6f [0071.659] GetTickCount () returned 0x1db6f [0071.659] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.758] GetTickCount () returned 0x1dbdd [0071.758] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.176] GetTickCount () returned 0x1dd72 [0072.176] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.345] GetTickCount () returned 0x1de1e [0072.345] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.444] GetTickCount () returned 0x1de8b [0072.444] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.686] GetTickCount () returned 0x1df75 [0072.686] GetTickCount () returned 0x1df75 [0072.686] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.800] GetTickCount () returned 0x1dfe2 [0072.801] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.897] GetTickCount () returned 0x1e04f [0072.897] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.006] GetTickCount () returned 0x1e0bd [0073.006] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.115] GetTickCount () returned 0x1e12a [0073.115] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.231] GetTickCount () returned 0x1e197 [0073.231] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.624] GetTickCount () returned 0x1e31d [0073.624] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.804] GetTickCount () returned 0x1e3d8 [0073.804] GetTickCount () returned 0x1e3d8 [0073.804] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.139] GetTickCount () returned 0x1e520 [0074.139] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0xa5c [0051.595] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x660638 [0051.595] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x670640 [0051.596] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6302b8 [0051.596] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x61a388 [0051.596] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6302d0 [0051.596] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3540020 [0051.596] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630270 [0051.596] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630270, Size=0x20) returned 0x65fec8 [0051.596] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630270 [0051.596] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630270, Size=0x20) returned 0x65fe78 [0051.596] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0051.597] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0051.597] Wow64DisableWow64FsRedirection (in: OldValue=0x223ff58 | out: OldValue=0x223ff58*=0x0) returned 1 [0051.597] lstrlenW (lpString="kernel32.dll") returned 12 [0051.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fec8 | out: hHeap=0x5e0000) returned 1 [0051.597] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0051.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fe78 | out: hHeap=0x5e0000) returned 1 [0051.597] Sleep (dwMilliseconds=0x64) [0051.756] Sleep (dwMilliseconds=0x64) [0052.200] Sleep (dwMilliseconds=0x64) [0052.387] Sleep (dwMilliseconds=0x64) [0052.555] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0052.555] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0052.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.787] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=3186) returned 1 [0052.788] CloseHandle (hObject=0x17c) returned 1 [0052.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0052.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.788] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.788] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.789] GetLastError () returned 0x0 [0052.789] ReadFile (in: hFile=0x17c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0xc72, lpOverlapped=0x0) returned 1 [0053.352] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0053.353] ReadFile (in: hFile=0x17c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.353] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0053.353] SetEndOfFile (hFile=0x16c) returned 1 [0053.353] CloseHandle (hObject=0x16c) returned 1 [0053.356] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.356] SetEndOfFile (hFile=0x17c) returned 1 [0053.357] CloseHandle (hObject=0x17c) returned 1 [0053.357] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0053.357] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0053.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.358] lstrlenW (lpString=".doc") returned 4 [0053.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.358] lstrlenW (lpString=".docx") returned 5 [0053.358] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0053.358] lstrlenW (lpString=".pdf") returned 4 [0053.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.358] lstrlenW (lpString=".xls") returned 4 [0053.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.358] lstrlenW (lpString=".xlsx") returned 5 [0053.358] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0053.358] lstrlenW (lpString=".ppt") returned 4 [0053.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.358] lstrlenW (lpString=".zip") returned 4 [0053.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.358] lstrlenW (lpString=".rar") returned 4 [0053.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.358] lstrlenW (lpString=".bz2") returned 4 [0053.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.358] lstrlenW (lpString=".7z") returned 3 [0053.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.358] lstrlenW (lpString=".dbf") returned 4 [0053.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.358] lstrlenW (lpString=".1cd") returned 4 [0053.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.359] lstrlenW (lpString=".jpg") returned 4 [0053.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.359] lstrlenW (lpString=".doc") returned 4 [0053.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.359] lstrlenW (lpString=".docx") returned 5 [0053.359] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0053.359] lstrlenW (lpString=".pdf") returned 4 [0053.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.359] lstrlenW (lpString=".xls") returned 4 [0053.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.359] lstrlenW (lpString=".xlsx") returned 5 [0053.359] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0053.359] lstrlenW (lpString=".ppt") returned 4 [0053.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.359] lstrlenW (lpString=".zip") returned 4 [0053.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.359] lstrlenW (lpString=".rar") returned 4 [0053.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.359] lstrlenW (lpString=".bz2") returned 4 [0053.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.359] lstrlenW (lpString=".7z") returned 3 [0053.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.359] lstrlenW (lpString=".dbf") returned 4 [0053.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.360] lstrlenW (lpString=".1cd") returned 4 [0053.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0053.360] lstrlenW (lpString=".jpg") returned 4 [0053.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.360] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.360] lstrlenW (lpString="Proof.xml") returned 9 [0053.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0053.549] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1457) returned 1 [0053.550] CloseHandle (hObject=0x168) returned 1 [0053.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0053.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0053.550] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.550] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.550] GetLastError () returned 0x0 [0053.550] ReadFile (in: hFile=0x168, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0053.708] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0053.709] ReadFile (in: hFile=0x168, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.710] SetEndOfFile (hFile=0x1ac) returned 1 [0053.710] CloseHandle (hObject=0x1ac) returned 1 [0053.712] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.712] SetEndOfFile (hFile=0x168) returned 1 [0053.713] CloseHandle (hObject=0x168) returned 1 [0053.713] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0053.713] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0053.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.713] lstrlenW (lpString=".doc") returned 4 [0053.713] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.713] lstrlenW (lpString=".docx") returned 5 [0053.713] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0053.713] lstrlenW (lpString=".pdf") returned 4 [0053.714] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.714] lstrlenW (lpString=".xls") returned 4 [0053.714] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.714] lstrlenW (lpString=".xlsx") returned 5 [0053.714] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0053.714] lstrlenW (lpString=".ppt") returned 4 [0053.714] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.714] lstrlenW (lpString=".zip") returned 4 [0053.714] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.714] lstrlenW (lpString=".rar") returned 4 [0053.714] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.714] lstrlenW (lpString=".bz2") returned 4 [0053.714] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.714] lstrlenW (lpString=".7z") returned 3 [0053.714] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.714] lstrlenW (lpString=".dbf") returned 4 [0053.714] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.714] lstrlenW (lpString=".1cd") returned 4 [0053.714] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.714] lstrlenW (lpString=".jpg") returned 4 [0053.714] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.714] lstrlenW (lpString=".doc") returned 4 [0053.714] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.715] lstrlenW (lpString=".docx") returned 5 [0053.715] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0053.715] lstrlenW (lpString=".pdf") returned 4 [0053.715] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.715] lstrlenW (lpString=".xls") returned 4 [0053.715] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.715] lstrlenW (lpString=".xlsx") returned 5 [0053.715] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0053.715] lstrlenW (lpString=".ppt") returned 4 [0053.715] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.715] lstrlenW (lpString=".zip") returned 4 [0053.715] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.715] lstrlenW (lpString=".rar") returned 4 [0053.715] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.715] lstrlenW (lpString=".bz2") returned 4 [0053.715] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.715] lstrlenW (lpString=".7z") returned 3 [0053.715] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.715] lstrlenW (lpString=".dbf") returned 4 [0053.715] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.715] lstrlenW (lpString=".1cd") returned 4 [0053.715] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0053.715] lstrlenW (lpString=".jpg") returned 4 [0053.715] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.716] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.716] lstrlenW (lpString="Setup.xml") returned 9 [0053.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0053.716] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=5884) returned 1 [0053.716] CloseHandle (hObject=0x168) returned 1 [0053.716] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.716] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0053.716] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.716] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.717] GetLastError () returned 0x0 [0053.717] ReadFile (in: hFile=0x168, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0053.981] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0053.982] ReadFile (in: hFile=0x168, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.982] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.982] SetEndOfFile (hFile=0x1ac) returned 1 [0053.982] CloseHandle (hObject=0x1ac) returned 1 [0053.988] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.988] SetEndOfFile (hFile=0x168) returned 1 [0053.989] CloseHandle (hObject=0x168) returned 1 [0053.989] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.008] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.008] lstrlenW (lpString=".doc") returned 4 [0054.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.008] lstrlenW (lpString=".docx") returned 5 [0054.008] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.008] lstrlenW (lpString=".pdf") returned 4 [0054.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.008] lstrlenW (lpString=".xls") returned 4 [0054.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".xlsx") returned 5 [0054.009] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.009] lstrlenW (lpString=".ppt") returned 4 [0054.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.009] lstrlenW (lpString=".zip") returned 4 [0054.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.009] lstrlenW (lpString=".rar") returned 4 [0054.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".bz2") returned 4 [0054.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".7z") returned 3 [0054.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.009] lstrlenW (lpString=".dbf") returned 4 [0054.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.009] lstrlenW (lpString=".1cd") returned 4 [0054.009] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.009] lstrlenW (lpString=".jpg") returned 4 [0054.009] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.009] lstrlenW (lpString=".doc") returned 4 [0054.009] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".docx") returned 5 [0054.009] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.009] lstrlenW (lpString=".pdf") returned 4 [0054.010] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString=".xls") returned 4 [0054.010] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString=".xlsx") returned 5 [0054.010] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.010] lstrlenW (lpString=".ppt") returned 4 [0054.010] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.010] lstrlenW (lpString=".zip") returned 4 [0054.010] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.010] lstrlenW (lpString=".rar") returned 4 [0054.010] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString=".bz2") returned 4 [0054.010] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString=".7z") returned 3 [0054.010] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.010] lstrlenW (lpString=".dbf") returned 4 [0054.010] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.010] lstrlenW (lpString=".1cd") returned 4 [0054.010] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.010] lstrlenW (lpString=".jpg") returned 4 [0054.010] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.010] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.010] lstrlenW (lpString="Setup.xml") returned 9 [0054.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0054.011] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1852) returned 1 [0054.011] CloseHandle (hObject=0x16c) returned 1 [0054.011] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.011] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0054.011] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.011] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0054.012] GetLastError () returned 0x0 [0054.012] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x73c, lpOverlapped=0x0) returned 1 [0054.278] WriteFile (in: hFile=0x17c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x740, lpOverlapped=0x0) returned 1 [0054.279] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.279] WriteFile (in: hFile=0x17c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.279] SetEndOfFile (hFile=0x17c) returned 1 [0054.279] CloseHandle (hObject=0x17c) returned 1 [0054.287] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.287] SetEndOfFile (hFile=0x16c) returned 1 [0054.288] CloseHandle (hObject=0x16c) returned 1 [0054.288] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.288] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.289] lstrlenW (lpString=".doc") returned 4 [0054.289] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.289] lstrlenW (lpString=".docx") returned 5 [0054.289] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.289] lstrlenW (lpString=".pdf") returned 4 [0054.289] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.289] lstrlenW (lpString=".xls") returned 4 [0054.289] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.289] lstrlenW (lpString=".xlsx") returned 5 [0054.289] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.289] lstrlenW (lpString=".ppt") returned 4 [0054.289] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.289] lstrlenW (lpString=".zip") returned 4 [0054.289] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.289] lstrlenW (lpString=".rar") returned 4 [0054.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.289] lstrlenW (lpString=".bz2") returned 4 [0054.289] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.289] lstrlenW (lpString=".7z") returned 3 [0054.289] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.289] lstrlenW (lpString=".dbf") returned 4 [0054.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.289] lstrlenW (lpString=".1cd") returned 4 [0054.289] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.289] lstrlenW (lpString=".jpg") returned 4 [0054.290] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.290] lstrlenW (lpString=".doc") returned 4 [0054.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.290] lstrlenW (lpString=".docx") returned 5 [0054.290] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.290] lstrlenW (lpString=".pdf") returned 4 [0054.290] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.290] lstrlenW (lpString=".xls") returned 4 [0054.290] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.290] lstrlenW (lpString=".xlsx") returned 5 [0054.290] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.290] lstrlenW (lpString=".ppt") returned 4 [0054.290] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.290] lstrlenW (lpString=".zip") returned 4 [0054.290] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.290] lstrlenW (lpString=".rar") returned 4 [0054.290] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.290] lstrlenW (lpString=".bz2") returned 4 [0054.290] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.290] lstrlenW (lpString=".7z") returned 3 [0054.290] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.290] lstrlenW (lpString=".dbf") returned 4 [0054.290] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.290] lstrlenW (lpString=".1cd") returned 4 [0054.290] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.291] lstrlenW (lpString=".jpg") returned 4 [0054.291] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.291] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.291] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0054.291] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.415] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1452) returned 1 [0054.415] CloseHandle (hObject=0x170) returned 1 [0054.415] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0054.416] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.416] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.416] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.416] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.416] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0054.416] GetLastError () returned 0x0 [0054.416] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0054.562] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0054.563] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.563] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0054.563] SetEndOfFile (hFile=0x16c) returned 1 [0054.563] CloseHandle (hObject=0x16c) returned 1 [0054.567] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.567] SetEndOfFile (hFile=0x170) returned 1 [0054.568] CloseHandle (hObject=0x170) returned 1 [0054.568] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.569] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0054.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.569] lstrlenW (lpString=".doc") returned 4 [0054.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.569] lstrlenW (lpString=".docx") returned 5 [0054.569] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.569] lstrlenW (lpString=".pdf") returned 4 [0054.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.569] lstrlenW (lpString=".xls") returned 4 [0054.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.569] lstrlenW (lpString=".xlsx") returned 5 [0054.569] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.569] lstrlenW (lpString=".ppt") returned 4 [0054.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.569] lstrlenW (lpString=".zip") returned 4 [0054.569] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.570] lstrlenW (lpString=".rar") returned 4 [0054.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString=".bz2") returned 4 [0054.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString=".7z") returned 3 [0054.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.570] lstrlenW (lpString=".dbf") returned 4 [0054.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.570] lstrlenW (lpString=".1cd") returned 4 [0054.570] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.570] lstrlenW (lpString=".jpg") returned 4 [0054.570] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.570] lstrlenW (lpString=".doc") returned 4 [0054.570] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString=".docx") returned 5 [0054.570] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.570] lstrlenW (lpString=".pdf") returned 4 [0054.570] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString=".xls") returned 4 [0054.570] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString=".xlsx") returned 5 [0054.570] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.570] lstrlenW (lpString=".ppt") returned 4 [0054.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.571] lstrlenW (lpString=".zip") returned 4 [0054.571] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.571] lstrlenW (lpString=".rar") returned 4 [0054.571] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.571] lstrlenW (lpString=".bz2") returned 4 [0054.571] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.571] lstrlenW (lpString=".7z") returned 3 [0054.571] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.571] lstrlenW (lpString=".dbf") returned 4 [0054.571] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.571] lstrlenW (lpString=".1cd") returned 4 [0054.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0054.571] lstrlenW (lpString=".jpg") returned 4 [0054.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.571] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.571] lstrlenW (lpString="Setup.xml") returned 9 [0054.571] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.572] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1452) returned 1 [0054.572] CloseHandle (hObject=0x170) returned 1 [0054.572] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.572] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.573] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.573] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0054.573] GetLastError () returned 0x0 [0054.573] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0054.987] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0054.988] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.990] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.990] SetEndOfFile (hFile=0x16c) returned 1 [0054.990] CloseHandle (hObject=0x16c) returned 1 [0054.996] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.996] SetEndOfFile (hFile=0x170) returned 1 [0054.998] CloseHandle (hObject=0x170) returned 1 [0054.998] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.999] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0055.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.000] lstrlenW (lpString=".doc") returned 4 [0055.000] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.000] lstrlenW (lpString=".docx") returned 5 [0055.000] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0055.000] lstrlenW (lpString=".pdf") returned 4 [0055.000] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.000] lstrlenW (lpString=".xls") returned 4 [0055.000] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.000] lstrlenW (lpString=".xlsx") returned 5 [0055.000] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0055.000] lstrlenW (lpString=".ppt") returned 4 [0055.000] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.000] lstrlenW (lpString=".zip") returned 4 [0055.000] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.001] lstrlenW (lpString=".rar") returned 4 [0055.001] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.001] lstrlenW (lpString=".bz2") returned 4 [0055.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.001] lstrlenW (lpString=".7z") returned 3 [0055.001] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.001] lstrlenW (lpString=".dbf") returned 4 [0055.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.001] lstrlenW (lpString=".1cd") returned 4 [0055.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.001] lstrlenW (lpString=".jpg") returned 4 [0055.001] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.001] lstrlenW (lpString=".doc") returned 4 [0055.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.001] lstrlenW (lpString=".docx") returned 5 [0055.001] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0055.002] lstrlenW (lpString=".pdf") returned 4 [0055.002] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.002] lstrlenW (lpString=".xls") returned 4 [0055.002] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.002] lstrlenW (lpString=".xlsx") returned 5 [0055.002] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0055.002] lstrlenW (lpString=".ppt") returned 4 [0055.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.002] lstrlenW (lpString=".zip") returned 4 [0055.002] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.002] lstrlenW (lpString=".rar") returned 4 [0055.002] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.002] lstrlenW (lpString=".bz2") returned 4 [0055.002] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.002] lstrlenW (lpString=".7z") returned 3 [0055.002] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.002] lstrlenW (lpString=".dbf") returned 4 [0055.002] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.003] lstrlenW (lpString=".1cd") returned 4 [0055.003] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.003] lstrlenW (lpString=".jpg") returned 4 [0055.003] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.004] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.004] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0055.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.005] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=5557) returned 1 [0055.005] CloseHandle (hObject=0x170) returned 1 [0055.005] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0055.005] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.006] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.006] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0055.006] GetLastError () returned 0x0 [0055.006] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0055.053] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0055.054] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.054] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xee, lpOverlapped=0x0) returned 1 [0055.054] SetEndOfFile (hFile=0x16c) returned 1 [0055.054] CloseHandle (hObject=0x16c) returned 1 [0055.060] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.060] SetEndOfFile (hFile=0x170) returned 1 [0055.061] CloseHandle (hObject=0x170) returned 1 [0055.061] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.062] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0055.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.062] lstrlenW (lpString=".doc") returned 4 [0055.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.062] lstrlenW (lpString=".docx") returned 5 [0055.062] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0055.062] lstrlenW (lpString=".pdf") returned 4 [0055.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.062] lstrlenW (lpString=".xls") returned 4 [0055.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.062] lstrlenW (lpString=".xlsx") returned 5 [0055.062] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0055.062] lstrlenW (lpString=".ppt") returned 4 [0055.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.062] lstrlenW (lpString=".zip") returned 4 [0055.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.062] lstrlenW (lpString=".rar") returned 4 [0055.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.062] lstrlenW (lpString=".bz2") returned 4 [0055.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.063] lstrlenW (lpString=".7z") returned 3 [0055.063] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.063] lstrlenW (lpString=".dbf") returned 4 [0055.063] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.063] lstrlenW (lpString=".1cd") returned 4 [0055.063] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.063] lstrlenW (lpString=".jpg") returned 4 [0055.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.063] lstrlenW (lpString=".doc") returned 4 [0055.063] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.063] lstrlenW (lpString=".docx") returned 5 [0055.063] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0055.063] lstrlenW (lpString=".pdf") returned 4 [0055.063] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.063] lstrlenW (lpString=".xls") returned 4 [0055.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.063] lstrlenW (lpString=".xlsx") returned 5 [0055.063] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0055.063] lstrlenW (lpString=".ppt") returned 4 [0055.063] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.064] lstrlenW (lpString=".zip") returned 4 [0055.064] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.064] lstrlenW (lpString=".rar") returned 4 [0055.064] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.064] lstrlenW (lpString=".bz2") returned 4 [0055.064] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.064] lstrlenW (lpString=".7z") returned 3 [0055.064] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.064] lstrlenW (lpString=".dbf") returned 4 [0055.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.064] lstrlenW (lpString=".1cd") returned 4 [0055.065] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0055.065] lstrlenW (lpString=".jpg") returned 4 [0055.065] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.065] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.066] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0055.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.066] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=819) returned 1 [0055.066] CloseHandle (hObject=0x170) returned 1 [0055.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0055.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.066] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.067] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.067] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0055.067] GetLastError () returned 0x0 [0055.067] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x333, lpOverlapped=0x0) returned 1 [0055.089] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x340, lpOverlapped=0x0) returned 1 [0055.090] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.091] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0055.091] SetEndOfFile (hFile=0x16c) returned 1 [0055.091] CloseHandle (hObject=0x16c) returned 1 [0055.092] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.092] SetEndOfFile (hFile=0x170) returned 1 [0055.092] CloseHandle (hObject=0x170) returned 1 [0055.093] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.093] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0055.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.093] lstrlenW (lpString=".doc") returned 4 [0055.093] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.093] lstrlenW (lpString=".docx") returned 5 [0055.093] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0055.093] lstrlenW (lpString=".pdf") returned 4 [0055.093] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.093] lstrlenW (lpString=".xls") returned 4 [0055.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.093] lstrlenW (lpString=".xlsx") returned 5 [0055.093] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0055.094] lstrlenW (lpString=".ppt") returned 4 [0055.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.094] lstrlenW (lpString=".zip") returned 4 [0055.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.094] lstrlenW (lpString=".rar") returned 4 [0055.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.094] lstrlenW (lpString=".bz2") returned 4 [0055.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.094] lstrlenW (lpString=".7z") returned 3 [0055.094] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.094] lstrlenW (lpString=".dbf") returned 4 [0055.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.094] lstrlenW (lpString=".1cd") returned 4 [0055.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.094] lstrlenW (lpString=".jpg") returned 4 [0055.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.094] lstrlenW (lpString=".doc") returned 4 [0055.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.094] lstrlenW (lpString=".docx") returned 5 [0055.094] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0055.094] lstrlenW (lpString=".pdf") returned 4 [0055.095] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.095] lstrlenW (lpString=".xls") returned 4 [0055.095] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.095] lstrlenW (lpString=".xlsx") returned 5 [0055.095] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0055.095] lstrlenW (lpString=".ppt") returned 4 [0055.095] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.095] lstrlenW (lpString=".zip") returned 4 [0055.095] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.095] lstrlenW (lpString=".rar") returned 4 [0055.095] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.095] lstrlenW (lpString=".bz2") returned 4 [0055.095] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.095] lstrlenW (lpString=".7z") returned 3 [0055.095] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.095] lstrlenW (lpString=".dbf") returned 4 [0055.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.095] lstrlenW (lpString=".1cd") returned 4 [0055.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0055.095] lstrlenW (lpString=".jpg") returned 4 [0055.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.096] lstrcmpiW (lpString1=".chm", lpString2=".beets") returned 1 [0055.096] lstrlenW (lpString="pss10r.chm") returned 10 [0055.096] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.097] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=27195) returned 1 [0055.097] CloseHandle (hObject=0x170) returned 1 [0055.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0055.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.097] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.098] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0055.098] GetLastError () returned 0x0 [0055.098] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0055.101] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0055.103] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.103] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0055.103] SetEndOfFile (hFile=0x16c) returned 1 [0055.103] CloseHandle (hObject=0x16c) returned 1 [0055.104] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.104] SetEndOfFile (hFile=0x170) returned 1 [0055.105] CloseHandle (hObject=0x170) returned 1 [0055.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.106] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0055.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.106] lstrlenW (lpString=".doc") returned 4 [0055.106] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0055.106] lstrlenW (lpString=".docx") returned 5 [0055.106] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0055.106] lstrlenW (lpString=".pdf") returned 4 [0055.106] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0055.106] lstrlenW (lpString=".xls") returned 4 [0055.106] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0055.106] lstrlenW (lpString=".xlsx") returned 5 [0055.106] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0055.106] lstrlenW (lpString=".ppt") returned 4 [0055.107] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.107] lstrlenW (lpString=".zip") returned 4 [0055.107] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0055.107] lstrlenW (lpString=".rar") returned 4 [0055.107] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0055.107] lstrlenW (lpString=".bz2") returned 4 [0055.107] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0055.107] lstrlenW (lpString=".7z") returned 3 [0055.107] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.107] lstrlenW (lpString=".dbf") returned 4 [0055.107] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.107] lstrlenW (lpString=".1cd") returned 4 [0055.107] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.107] lstrlenW (lpString=".jpg") returned 4 [0055.107] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.107] lstrlenW (lpString=".doc") returned 4 [0055.107] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0055.107] lstrlenW (lpString=".docx") returned 5 [0055.107] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0055.107] lstrlenW (lpString=".pdf") returned 4 [0055.107] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0055.108] lstrlenW (lpString=".xls") returned 4 [0055.108] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0055.108] lstrlenW (lpString=".xlsx") returned 5 [0055.108] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0055.108] lstrlenW (lpString=".ppt") returned 4 [0055.108] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.108] lstrlenW (lpString=".zip") returned 4 [0055.108] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0055.108] lstrlenW (lpString=".rar") returned 4 [0055.108] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0055.108] lstrlenW (lpString=".bz2") returned 4 [0055.108] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0055.108] lstrlenW (lpString=".7z") returned 3 [0055.108] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.108] lstrlenW (lpString=".dbf") returned 4 [0055.108] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.108] lstrlenW (lpString=".1cd") returned 4 [0055.108] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0055.108] lstrlenW (lpString=".jpg") returned 4 [0055.109] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0055.109] lstrcmpiW (lpString1=".chm", lpString2=".beets") returned 1 [0055.109] lstrlenW (lpString="setup.chm") returned 9 [0055.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.109] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=67190) returned 1 [0055.109] CloseHandle (hObject=0x170) returned 1 [0055.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0055.110] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.110] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.110] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0055.110] GetLastError () returned 0x0 [0055.110] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x10676, lpOverlapped=0x0) returned 1 [0055.132] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0055.133] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.133] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.133] SetEndOfFile (hFile=0x16c) returned 1 [0055.133] CloseHandle (hObject=0x16c) returned 1 [0055.135] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.135] SetEndOfFile (hFile=0x170) returned 1 [0055.136] CloseHandle (hObject=0x170) returned 1 [0055.136] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.136] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0055.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.137] lstrlenW (lpString=".doc") returned 4 [0055.137] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0055.137] lstrlenW (lpString=".docx") returned 5 [0055.137] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0055.137] lstrlenW (lpString=".pdf") returned 4 [0055.137] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0055.137] lstrlenW (lpString=".xls") returned 4 [0055.137] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0055.137] lstrlenW (lpString=".xlsx") returned 5 [0055.137] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0055.137] lstrlenW (lpString=".ppt") returned 4 [0055.137] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0055.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.137] lstrlenW (lpString=".zip") returned 4 [0055.137] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0055.137] lstrlenW (lpString=".rar") returned 4 [0055.137] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0055.137] lstrlenW (lpString=".bz2") returned 4 [0055.137] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0055.137] lstrlenW (lpString=".7z") returned 3 [0055.137] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0055.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.137] lstrlenW (lpString=".dbf") returned 4 [0055.137] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0055.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.137] lstrlenW (lpString=".1cd") returned 4 [0055.137] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0055.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.137] lstrlenW (lpString=".jpg") returned 4 [0055.138] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0055.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.138] lstrlenW (lpString=".doc") returned 4 [0055.138] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0055.138] lstrlenW (lpString=".docx") returned 5 [0055.138] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0055.138] lstrlenW (lpString=".pdf") returned 4 [0055.138] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0055.138] lstrlenW (lpString=".xls") returned 4 [0055.138] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0055.138] lstrlenW (lpString=".xlsx") returned 5 [0055.138] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0055.138] lstrlenW (lpString=".ppt") returned 4 [0055.138] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0055.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.138] lstrlenW (lpString=".zip") returned 4 [0055.138] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0055.138] lstrlenW (lpString=".rar") returned 4 [0055.138] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0055.138] lstrlenW (lpString=".bz2") returned 4 [0055.138] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0055.138] lstrlenW (lpString=".7z") returned 3 [0055.138] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0055.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.138] lstrlenW (lpString=".dbf") returned 4 [0055.138] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0055.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.138] lstrlenW (lpString=".1cd") returned 4 [0055.139] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0055.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0055.139] lstrlenW (lpString=".jpg") returned 4 [0055.139] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0055.139] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.139] lstrlenW (lpString="AccessMUI.xml") returned 13 [0055.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.141] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1349) returned 1 [0055.141] CloseHandle (hObject=0x170) returned 1 [0055.141] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0055.141] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.141] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.141] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0055.141] GetLastError () returned 0x0 [0055.141] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x545, lpOverlapped=0x0) returned 1 [0055.156] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x550, lpOverlapped=0x0) returned 1 [0055.157] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.157] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xee, lpOverlapped=0x0) returned 1 [0055.157] SetEndOfFile (hFile=0x16c) returned 1 [0055.157] CloseHandle (hObject=0x16c) returned 1 [0055.158] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.158] SetEndOfFile (hFile=0x170) returned 1 [0055.159] CloseHandle (hObject=0x170) returned 1 [0055.159] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.159] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0055.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.160] lstrlenW (lpString=".doc") returned 4 [0055.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.160] lstrlenW (lpString=".docx") returned 5 [0055.160] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0055.160] lstrlenW (lpString=".pdf") returned 4 [0055.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.160] lstrlenW (lpString=".xls") returned 4 [0055.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.160] lstrlenW (lpString=".xlsx") returned 5 [0055.160] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0055.160] lstrlenW (lpString=".ppt") returned 4 [0055.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.160] lstrlenW (lpString=".zip") returned 4 [0055.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.160] lstrlenW (lpString=".rar") returned 4 [0055.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.160] lstrlenW (lpString=".bz2") returned 4 [0055.160] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.160] lstrlenW (lpString=".7z") returned 3 [0055.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.160] lstrlenW (lpString=".dbf") returned 4 [0055.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.160] lstrlenW (lpString=".1cd") returned 4 [0055.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.161] lstrlenW (lpString=".jpg") returned 4 [0055.161] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.161] lstrlenW (lpString=".doc") returned 4 [0055.161] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.161] lstrlenW (lpString=".docx") returned 5 [0055.161] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0055.161] lstrlenW (lpString=".pdf") returned 4 [0055.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.161] lstrlenW (lpString=".xls") returned 4 [0055.161] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.161] lstrlenW (lpString=".xlsx") returned 5 [0055.161] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0055.161] lstrlenW (lpString=".ppt") returned 4 [0055.161] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.161] lstrlenW (lpString=".zip") returned 4 [0055.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.161] lstrlenW (lpString=".rar") returned 4 [0055.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.161] lstrlenW (lpString=".bz2") returned 4 [0055.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.161] lstrlenW (lpString=".7z") returned 3 [0055.162] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.162] lstrlenW (lpString=".dbf") returned 4 [0055.162] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.162] lstrlenW (lpString=".1cd") returned 4 [0055.162] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0055.162] lstrlenW (lpString=".jpg") returned 4 [0055.162] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.162] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.162] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0055.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.162] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=819) returned 1 [0055.162] CloseHandle (hObject=0x170) returned 1 [0055.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0055.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.163] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.163] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0055.163] GetLastError () returned 0x0 [0055.163] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x333, lpOverlapped=0x0) returned 1 [0055.815] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x340, lpOverlapped=0x0) returned 1 [0055.816] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.816] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0055.816] SetEndOfFile (hFile=0x16c) returned 1 [0055.817] CloseHandle (hObject=0x16c) returned 1 [0055.818] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.818] SetEndOfFile (hFile=0x170) returned 1 [0055.822] CloseHandle (hObject=0x170) returned 1 [0055.823] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.824] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0055.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.824] lstrlenW (lpString=".doc") returned 4 [0055.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.825] lstrlenW (lpString=".docx") returned 5 [0055.825] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0055.825] lstrlenW (lpString=".pdf") returned 4 [0055.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.825] lstrlenW (lpString=".xls") returned 4 [0055.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.825] lstrlenW (lpString=".xlsx") returned 5 [0055.825] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0055.825] lstrlenW (lpString=".ppt") returned 4 [0055.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.825] lstrlenW (lpString=".zip") returned 4 [0055.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.825] lstrlenW (lpString=".rar") returned 4 [0055.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.826] lstrlenW (lpString=".bz2") returned 4 [0055.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.826] lstrlenW (lpString=".7z") returned 3 [0055.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.826] lstrlenW (lpString=".dbf") returned 4 [0055.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.826] lstrlenW (lpString=".1cd") returned 4 [0055.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.826] lstrlenW (lpString=".jpg") returned 4 [0055.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.827] lstrlenW (lpString=".doc") returned 4 [0055.827] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.827] lstrlenW (lpString=".docx") returned 5 [0055.827] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0055.827] lstrlenW (lpString=".pdf") returned 4 [0055.827] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.827] lstrlenW (lpString=".xls") returned 4 [0055.827] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.827] lstrlenW (lpString=".xlsx") returned 5 [0055.827] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0055.827] lstrlenW (lpString=".ppt") returned 4 [0055.828] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.828] lstrlenW (lpString=".zip") returned 4 [0055.828] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.828] lstrlenW (lpString=".rar") returned 4 [0055.828] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.828] lstrlenW (lpString=".bz2") returned 4 [0055.828] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.828] lstrlenW (lpString=".7z") returned 3 [0055.828] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.828] lstrlenW (lpString=".dbf") returned 4 [0055.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.828] lstrlenW (lpString=".1cd") returned 4 [0055.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0055.829] lstrlenW (lpString=".jpg") returned 4 [0055.829] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.829] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.829] lstrlenW (lpString="Office32WW.xml") returned 14 [0055.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.832] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=4274) returned 1 [0055.832] CloseHandle (hObject=0x170) returned 1 [0055.832] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0055.832] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.832] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.832] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.832] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.832] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0055.833] GetLastError () returned 0x0 [0055.833] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0056.641] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0056.642] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.642] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0056.643] SetEndOfFile (hFile=0x16c) returned 1 [0056.643] CloseHandle (hObject=0x16c) returned 1 [0056.644] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.644] SetEndOfFile (hFile=0x170) returned 1 [0056.645] CloseHandle (hObject=0x170) returned 1 [0056.645] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.645] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0056.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.645] lstrlenW (lpString=".doc") returned 4 [0056.645] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.645] lstrlenW (lpString=".docx") returned 5 [0056.646] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.646] lstrlenW (lpString=".pdf") returned 4 [0056.646] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.646] lstrlenW (lpString=".xls") returned 4 [0056.646] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.646] lstrlenW (lpString=".xlsx") returned 5 [0056.646] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.646] lstrlenW (lpString=".ppt") returned 4 [0056.646] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.646] lstrlenW (lpString=".zip") returned 4 [0056.646] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.646] lstrlenW (lpString=".rar") returned 4 [0056.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.646] lstrlenW (lpString=".bz2") returned 4 [0056.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.646] lstrlenW (lpString=".7z") returned 3 [0056.646] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.646] lstrlenW (lpString=".dbf") returned 4 [0056.646] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.646] lstrlenW (lpString=".1cd") returned 4 [0056.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.646] lstrlenW (lpString=".jpg") returned 4 [0056.646] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.646] lstrlenW (lpString=".doc") returned 4 [0056.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.647] lstrlenW (lpString=".docx") returned 5 [0056.647] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.647] lstrlenW (lpString=".pdf") returned 4 [0056.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.647] lstrlenW (lpString=".xls") returned 4 [0056.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.647] lstrlenW (lpString=".xlsx") returned 5 [0056.647] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.647] lstrlenW (lpString=".ppt") returned 4 [0056.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.647] lstrlenW (lpString=".zip") returned 4 [0056.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.647] lstrlenW (lpString=".rar") returned 4 [0056.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.647] lstrlenW (lpString=".bz2") returned 4 [0056.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.647] lstrlenW (lpString=".7z") returned 3 [0056.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.647] lstrlenW (lpString=".dbf") returned 4 [0056.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.647] lstrlenW (lpString=".1cd") returned 4 [0056.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.647] lstrlenW (lpString=".jpg") returned 4 [0056.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.648] lstrcmpiW (lpString1=".EPS", lpString2=".beets") returned 1 [0056.648] lstrlenW (lpString="MS.EPS") returned 6 [0056.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.661] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=15067) returned 1 [0056.661] CloseHandle (hObject=0x1b4) returned 1 [0056.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0056.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.661] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.661] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.664] GetLastError () returned 0x0 [0056.664] ReadFile (in: hFile=0x1b4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0056.666] WriteFile (in: hFile=0x160, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0056.667] ReadFile (in: hFile=0x1b4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.667] WriteFile (in: hFile=0x160, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0056.667] SetEndOfFile (hFile=0x160) returned 1 [0056.668] CloseHandle (hObject=0x160) returned 1 [0056.672] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.672] SetEndOfFile (hFile=0x1b4) returned 1 [0056.673] CloseHandle (hObject=0x1b4) returned 1 [0056.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0056.673] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0056.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.673] lstrlenW (lpString=".doc") returned 4 [0056.674] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0056.674] lstrlenW (lpString=".docx") returned 5 [0056.674] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0056.674] lstrlenW (lpString=".pdf") returned 4 [0056.674] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0056.674] lstrlenW (lpString=".xls") returned 4 [0056.674] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0056.674] lstrlenW (lpString=".xlsx") returned 5 [0056.674] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0056.674] lstrlenW (lpString=".ppt") returned 4 [0056.674] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0056.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.674] lstrlenW (lpString=".zip") returned 4 [0056.674] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0056.674] lstrlenW (lpString=".rar") returned 4 [0056.674] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0056.674] lstrlenW (lpString=".bz2") returned 4 [0056.674] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0056.674] lstrlenW (lpString=".7z") returned 3 [0056.674] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0056.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.674] lstrlenW (lpString=".dbf") returned 4 [0056.674] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0056.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.674] lstrlenW (lpString=".1cd") returned 4 [0056.674] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0056.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.674] lstrlenW (lpString=".jpg") returned 4 [0056.674] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0056.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.675] lstrlenW (lpString=".doc") returned 4 [0056.675] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0056.675] lstrlenW (lpString=".docx") returned 5 [0056.675] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0056.675] lstrlenW (lpString=".pdf") returned 4 [0056.675] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0056.675] lstrlenW (lpString=".xls") returned 4 [0056.675] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0056.675] lstrlenW (lpString=".xlsx") returned 5 [0056.675] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0056.675] lstrlenW (lpString=".ppt") returned 4 [0056.675] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0056.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.675] lstrlenW (lpString=".zip") returned 4 [0056.675] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0056.675] lstrlenW (lpString=".rar") returned 4 [0056.675] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0056.675] lstrlenW (lpString=".bz2") returned 4 [0056.675] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0056.675] lstrlenW (lpString=".7z") returned 3 [0056.675] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0056.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.675] lstrlenW (lpString=".dbf") returned 4 [0056.675] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0056.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.675] lstrlenW (lpString=".1cd") returned 4 [0056.675] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0056.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0056.676] lstrlenW (lpString=".jpg") returned 4 [0056.676] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0056.676] lstrcmpiW (lpString1=".JPG", lpString2=".beets") returned 1 [0056.676] lstrlenW (lpString="MS.JPG") returned 6 [0056.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.677] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1061) returned 1 [0056.677] CloseHandle (hObject=0x1b4) returned 1 [0056.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0056.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.677] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.677] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.678] GetLastError () returned 0x0 [0056.678] ReadFile (in: hFile=0x1b4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x425, lpOverlapped=0x0) returned 1 [0056.798] WriteFile (in: hFile=0x160, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x430, lpOverlapped=0x0) returned 1 [0056.799] ReadFile (in: hFile=0x1b4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.799] WriteFile (in: hFile=0x160, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0056.799] SetEndOfFile (hFile=0x160) returned 1 [0056.799] CloseHandle (hObject=0x160) returned 1 [0056.908] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.908] SetEndOfFile (hFile=0x1b4) returned 1 [0056.909] CloseHandle (hObject=0x1b4) returned 1 [0056.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0056.909] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0056.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.909] lstrlenW (lpString=".doc") returned 4 [0056.909] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0056.909] lstrlenW (lpString=".docx") returned 5 [0056.909] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0056.909] lstrlenW (lpString=".pdf") returned 4 [0056.909] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0056.910] lstrlenW (lpString=".xls") returned 4 [0056.910] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0056.910] lstrlenW (lpString=".xlsx") returned 5 [0056.910] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0056.910] lstrlenW (lpString=".ppt") returned 4 [0056.910] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0056.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.910] lstrlenW (lpString=".zip") returned 4 [0056.910] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0056.910] lstrlenW (lpString=".rar") returned 4 [0056.910] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0056.910] lstrlenW (lpString=".bz2") returned 4 [0056.910] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0056.910] lstrlenW (lpString=".7z") returned 3 [0056.910] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0056.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.910] lstrlenW (lpString=".dbf") returned 4 [0056.910] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0056.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.910] lstrlenW (lpString=".1cd") returned 4 [0056.910] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0056.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.910] lstrlenW (lpString=".jpg") returned 4 [0056.910] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0056.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.910] lstrlenW (lpString=".doc") returned 4 [0056.910] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0056.911] lstrlenW (lpString=".docx") returned 5 [0056.911] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0056.911] lstrlenW (lpString=".pdf") returned 4 [0056.911] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0056.911] lstrlenW (lpString=".xls") returned 4 [0056.911] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0056.911] lstrlenW (lpString=".xlsx") returned 5 [0056.911] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0056.911] lstrlenW (lpString=".ppt") returned 4 [0056.911] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0056.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.911] lstrlenW (lpString=".zip") returned 4 [0056.911] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0056.911] lstrlenW (lpString=".rar") returned 4 [0056.911] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0056.911] lstrlenW (lpString=".bz2") returned 4 [0056.911] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0056.911] lstrlenW (lpString=".7z") returned 3 [0056.911] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0056.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.911] lstrlenW (lpString=".dbf") returned 4 [0056.911] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0056.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.911] lstrlenW (lpString=".1cd") returned 4 [0056.911] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0056.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0056.911] lstrlenW (lpString=".jpg") returned 4 [0056.911] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0056.912] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.912] lstrlenW (lpString="Alphabet.xml") returned 12 [0056.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0058.124] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=791686) returned 1 [0058.124] CloseHandle (hObject=0x1c0) returned 1 [0058.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0058.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0058.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.124] lstrlenW (lpString=".doc") returned 4 [0058.124] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.124] lstrlenW (lpString=".docx") returned 5 [0058.124] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0058.124] lstrlenW (lpString=".pdf") returned 4 [0058.124] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.124] lstrlenW (lpString=".xls") returned 4 [0058.125] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.125] lstrlenW (lpString=".xlsx") returned 5 [0058.125] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0058.125] lstrlenW (lpString=".ppt") returned 4 [0058.125] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.125] lstrlenW (lpString=".zip") returned 4 [0058.125] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.125] lstrlenW (lpString=".rar") returned 4 [0058.125] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.125] lstrlenW (lpString=".bz2") returned 4 [0058.125] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.125] lstrlenW (lpString=".7z") returned 3 [0058.125] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.125] lstrlenW (lpString=".dbf") returned 4 [0058.125] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.125] lstrlenW (lpString=".1cd") returned 4 [0058.125] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.125] lstrlenW (lpString=".jpg") returned 4 [0058.125] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.125] lstrlenW (lpString=".doc") returned 4 [0058.125] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.125] lstrlenW (lpString=".docx") returned 5 [0058.125] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0058.126] lstrlenW (lpString=".pdf") returned 4 [0058.126] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.126] lstrlenW (lpString=".xls") returned 4 [0058.126] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.126] lstrlenW (lpString=".xlsx") returned 5 [0058.126] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0058.126] lstrlenW (lpString=".ppt") returned 4 [0058.126] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.126] lstrlenW (lpString=".zip") returned 4 [0058.126] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.126] lstrlenW (lpString=".rar") returned 4 [0058.126] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.126] lstrlenW (lpString=".bz2") returned 4 [0058.126] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.126] lstrlenW (lpString=".7z") returned 3 [0058.126] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.126] lstrlenW (lpString=".dbf") returned 4 [0058.126] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.126] lstrlenW (lpString=".1cd") returned 4 [0058.126] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0058.126] lstrlenW (lpString=".jpg") returned 4 [0058.126] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.126] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0058.127] lstrlenW (lpString="boxed-join.avi") returned 14 [0058.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.328] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=33280) returned 1 [0059.328] CloseHandle (hObject=0x1a4) returned 1 [0059.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0059.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.328] lstrlenW (lpString=".doc") returned 4 [0059.328] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString=".docx") returned 5 [0059.329] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0059.329] lstrlenW (lpString=".pdf") returned 4 [0059.329] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString=".xls") returned 4 [0059.329] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString=".xlsx") returned 5 [0059.329] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0059.329] lstrlenW (lpString=".ppt") returned 4 [0059.329] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.329] lstrlenW (lpString=".zip") returned 4 [0059.329] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString=".rar") returned 4 [0059.329] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString=".bz2") returned 4 [0059.329] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString=".7z") returned 3 [0059.329] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.329] lstrlenW (lpString=".dbf") returned 4 [0059.329] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.329] lstrlenW (lpString=".1cd") returned 4 [0059.329] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.329] lstrlenW (lpString=".jpg") returned 4 [0059.329] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.329] lstrlenW (lpString=".doc") returned 4 [0059.329] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.330] lstrlenW (lpString=".docx") returned 5 [0059.330] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0059.330] lstrlenW (lpString=".pdf") returned 4 [0059.330] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.330] lstrlenW (lpString=".xls") returned 4 [0059.330] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.330] lstrlenW (lpString=".xlsx") returned 5 [0059.330] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0059.330] lstrlenW (lpString=".ppt") returned 4 [0059.330] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.330] lstrlenW (lpString=".zip") returned 4 [0059.330] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.330] lstrlenW (lpString=".rar") returned 4 [0059.330] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.330] lstrlenW (lpString=".bz2") returned 4 [0059.330] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.330] lstrlenW (lpString=".7z") returned 3 [0059.330] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.330] lstrlenW (lpString=".dbf") returned 4 [0059.330] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.330] lstrlenW (lpString=".1cd") returned 4 [0059.330] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0059.330] lstrlenW (lpString=".jpg") returned 4 [0059.330] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.331] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.331] lstrlenW (lpString="ea.xml") returned 6 [0059.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.629] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=384) returned 1 [0059.629] CloseHandle (hObject=0x1a4) returned 1 [0059.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0059.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.629] lstrlenW (lpString=".doc") returned 4 [0059.629] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.629] lstrlenW (lpString=".docx") returned 5 [0059.629] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0059.629] lstrlenW (lpString=".pdf") returned 4 [0059.629] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.629] lstrlenW (lpString=".xls") returned 4 [0059.629] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.629] lstrlenW (lpString=".xlsx") returned 5 [0059.629] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0059.630] lstrlenW (lpString=".ppt") returned 4 [0059.630] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.630] lstrlenW (lpString=".zip") returned 4 [0059.630] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.630] lstrlenW (lpString=".rar") returned 4 [0059.630] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.630] lstrlenW (lpString=".bz2") returned 4 [0059.630] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.630] lstrlenW (lpString=".7z") returned 3 [0059.630] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.630] lstrlenW (lpString=".dbf") returned 4 [0059.630] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.630] lstrlenW (lpString=".1cd") returned 4 [0059.630] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.630] lstrlenW (lpString=".jpg") returned 4 [0059.630] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.630] lstrlenW (lpString=".doc") returned 4 [0059.630] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.630] lstrlenW (lpString=".docx") returned 5 [0059.631] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0059.631] lstrlenW (lpString=".pdf") returned 4 [0059.631] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.631] lstrlenW (lpString=".xls") returned 4 [0059.631] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.631] lstrlenW (lpString=".xlsx") returned 5 [0059.631] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0059.631] lstrlenW (lpString=".ppt") returned 4 [0059.631] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.631] lstrlenW (lpString=".zip") returned 4 [0059.631] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.631] lstrlenW (lpString=".rar") returned 4 [0059.631] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.631] lstrlenW (lpString=".bz2") returned 4 [0059.631] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.631] lstrlenW (lpString=".7z") returned 3 [0059.631] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.631] lstrlenW (lpString=".dbf") returned 4 [0059.631] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.631] lstrlenW (lpString=".1cd") returned 4 [0059.631] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0059.631] lstrlenW (lpString=".jpg") returned 4 [0059.631] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.632] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.632] lstrlenW (lpString="ja-jp.xml") returned 9 [0059.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.524] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=16616) returned 1 [0060.524] CloseHandle (hObject=0x184) returned 1 [0060.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0060.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.524] lstrlenW (lpString=".doc") returned 4 [0060.524] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.524] lstrlenW (lpString=".docx") returned 5 [0060.524] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.524] lstrlenW (lpString=".pdf") returned 4 [0060.524] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.524] lstrlenW (lpString=".xls") returned 4 [0060.524] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.524] lstrlenW (lpString=".xlsx") returned 5 [0060.524] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.524] lstrlenW (lpString=".ppt") returned 4 [0060.524] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.524] lstrlenW (lpString=".zip") returned 4 [0060.525] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.525] lstrlenW (lpString=".rar") returned 4 [0060.525] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.525] lstrlenW (lpString=".bz2") returned 4 [0060.525] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.525] lstrlenW (lpString=".7z") returned 3 [0060.525] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.525] lstrlenW (lpString=".dbf") returned 4 [0060.525] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.525] lstrlenW (lpString=".1cd") returned 4 [0060.525] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.525] lstrlenW (lpString=".jpg") returned 4 [0060.525] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.525] lstrlenW (lpString=".doc") returned 4 [0060.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.525] lstrlenW (lpString=".docx") returned 5 [0060.525] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0060.525] lstrlenW (lpString=".pdf") returned 4 [0060.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.526] lstrlenW (lpString=".xls") returned 4 [0060.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.526] lstrlenW (lpString=".xlsx") returned 5 [0060.526] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0060.526] lstrlenW (lpString=".ppt") returned 4 [0060.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.526] lstrlenW (lpString=".zip") returned 4 [0060.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.526] lstrlenW (lpString=".rar") returned 4 [0060.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.526] lstrlenW (lpString=".bz2") returned 4 [0060.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.526] lstrlenW (lpString=".7z") returned 3 [0060.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.526] lstrlenW (lpString=".dbf") returned 4 [0060.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.526] lstrlenW (lpString=".1cd") returned 4 [0060.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0060.526] lstrlenW (lpString=".jpg") returned 4 [0060.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.527] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.527] lstrlenW (lpString="zh-dayi.xml") returned 11 [0060.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.527] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=11067) returned 1 [0060.527] CloseHandle (hObject=0x184) returned 1 [0060.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0060.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.528] lstrlenW (lpString=".doc") returned 4 [0060.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.528] lstrlenW (lpString=".docx") returned 5 [0060.528] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0060.528] lstrlenW (lpString=".pdf") returned 4 [0060.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.528] lstrlenW (lpString=".xls") returned 4 [0060.528] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.528] lstrlenW (lpString=".xlsx") returned 5 [0060.528] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0060.528] lstrlenW (lpString=".ppt") returned 4 [0060.528] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.528] lstrlenW (lpString=".zip") returned 4 [0060.528] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.528] lstrlenW (lpString=".rar") returned 4 [0060.528] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.528] lstrlenW (lpString=".bz2") returned 4 [0060.528] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.528] lstrlenW (lpString=".7z") returned 3 [0060.528] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.528] lstrlenW (lpString=".dbf") returned 4 [0060.528] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.528] lstrlenW (lpString=".1cd") returned 4 [0060.528] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.529] lstrlenW (lpString=".jpg") returned 4 [0060.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.529] lstrlenW (lpString=".doc") returned 4 [0060.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.529] lstrlenW (lpString=".docx") returned 5 [0060.529] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0060.529] lstrlenW (lpString=".pdf") returned 4 [0060.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.529] lstrlenW (lpString=".xls") returned 4 [0060.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.529] lstrlenW (lpString=".xlsx") returned 5 [0060.529] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0060.529] lstrlenW (lpString=".ppt") returned 4 [0060.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.529] lstrlenW (lpString=".zip") returned 4 [0060.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.529] lstrlenW (lpString=".rar") returned 4 [0060.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.529] lstrlenW (lpString=".bz2") returned 4 [0060.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.529] lstrlenW (lpString=".7z") returned 3 [0060.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.530] lstrlenW (lpString=".dbf") returned 4 [0060.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.530] lstrlenW (lpString=".1cd") returned 4 [0060.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0060.530] lstrlenW (lpString=".jpg") returned 4 [0060.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.530] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.530] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0060.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.534] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=10947) returned 1 [0060.534] CloseHandle (hObject=0x184) returned 1 [0060.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0060.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.534] lstrlenW (lpString=".doc") returned 4 [0060.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.534] lstrlenW (lpString=".docx") returned 5 [0060.534] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0060.534] lstrlenW (lpString=".pdf") returned 4 [0060.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.534] lstrlenW (lpString=".xls") returned 4 [0060.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.534] lstrlenW (lpString=".xlsx") returned 5 [0060.534] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0060.534] lstrlenW (lpString=".ppt") returned 4 [0060.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.535] lstrlenW (lpString=".zip") returned 4 [0060.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.535] lstrlenW (lpString=".rar") returned 4 [0060.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.535] lstrlenW (lpString=".bz2") returned 4 [0060.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.535] lstrlenW (lpString=".7z") returned 3 [0060.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.535] lstrlenW (lpString=".dbf") returned 4 [0060.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.535] lstrlenW (lpString=".1cd") returned 4 [0060.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.535] lstrlenW (lpString=".jpg") returned 4 [0060.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.535] lstrlenW (lpString=".doc") returned 4 [0060.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.535] lstrlenW (lpString=".docx") returned 5 [0060.535] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0060.535] lstrlenW (lpString=".pdf") returned 4 [0060.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.535] lstrlenW (lpString=".xls") returned 4 [0060.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.535] lstrlenW (lpString=".xlsx") returned 5 [0060.535] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0060.536] lstrlenW (lpString=".ppt") returned 4 [0060.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.536] lstrlenW (lpString=".zip") returned 4 [0060.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.536] lstrlenW (lpString=".rar") returned 4 [0060.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.536] lstrlenW (lpString=".bz2") returned 4 [0060.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.536] lstrlenW (lpString=".7z") returned 3 [0060.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.536] lstrlenW (lpString=".dbf") returned 4 [0060.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.536] lstrlenW (lpString=".1cd") returned 4 [0060.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0060.536] lstrlenW (lpString=".jpg") returned 4 [0060.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.536] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.536] lstrlenW (lpString="main.xml") returned 8 [0060.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.537] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=38485) returned 1 [0060.537] CloseHandle (hObject=0x184) returned 1 [0060.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0060.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.537] lstrlenW (lpString=".doc") returned 4 [0060.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.537] lstrlenW (lpString=".docx") returned 5 [0060.537] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0060.537] lstrlenW (lpString=".pdf") returned 4 [0060.537] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.537] lstrlenW (lpString=".xls") returned 4 [0060.537] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.537] lstrlenW (lpString=".xlsx") returned 5 [0060.537] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0060.537] lstrlenW (lpString=".ppt") returned 4 [0060.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.537] lstrlenW (lpString=".zip") returned 4 [0060.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.537] lstrlenW (lpString=".rar") returned 4 [0060.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString=".bz2") returned 4 [0060.538] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString=".7z") returned 3 [0060.538] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.538] lstrlenW (lpString=".dbf") returned 4 [0060.538] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.538] lstrlenW (lpString=".1cd") returned 4 [0060.538] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.538] lstrlenW (lpString=".jpg") returned 4 [0060.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.538] lstrlenW (lpString=".doc") returned 4 [0060.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString=".docx") returned 5 [0060.538] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0060.538] lstrlenW (lpString=".pdf") returned 4 [0060.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString=".xls") returned 4 [0060.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString=".xlsx") returned 5 [0060.538] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0060.538] lstrlenW (lpString=".ppt") returned 4 [0060.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.538] lstrlenW (lpString=".zip") returned 4 [0060.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.538] lstrlenW (lpString=".rar") returned 4 [0060.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.539] lstrlenW (lpString=".bz2") returned 4 [0060.539] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.539] lstrlenW (lpString=".7z") returned 3 [0060.539] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.539] lstrlenW (lpString=".dbf") returned 4 [0060.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.539] lstrlenW (lpString=".1cd") returned 4 [0060.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0060.539] lstrlenW (lpString=".jpg") returned 4 [0060.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.539] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.539] lstrlenW (lpString="numbase.xml") returned 11 [0060.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.539] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1218) returned 1 [0060.539] CloseHandle (hObject=0x184) returned 1 [0060.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0060.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.540] lstrlenW (lpString=".doc") returned 4 [0060.540] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.540] lstrlenW (lpString=".docx") returned 5 [0060.540] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0060.540] lstrlenW (lpString=".pdf") returned 4 [0060.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.540] lstrlenW (lpString=".xls") returned 4 [0060.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.540] lstrlenW (lpString=".xlsx") returned 5 [0060.540] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0060.540] lstrlenW (lpString=".ppt") returned 4 [0060.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.540] lstrlenW (lpString=".zip") returned 4 [0060.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.540] lstrlenW (lpString=".rar") returned 4 [0060.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.540] lstrlenW (lpString=".bz2") returned 4 [0060.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.540] lstrlenW (lpString=".7z") returned 3 [0060.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.540] lstrlenW (lpString=".dbf") returned 4 [0060.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.541] lstrlenW (lpString=".1cd") returned 4 [0060.541] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.541] lstrlenW (lpString=".jpg") returned 4 [0060.541] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.541] lstrlenW (lpString=".doc") returned 4 [0060.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.541] lstrlenW (lpString=".docx") returned 5 [0060.541] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0060.541] lstrlenW (lpString=".pdf") returned 4 [0060.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.541] lstrlenW (lpString=".xls") returned 4 [0060.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.541] lstrlenW (lpString=".xlsx") returned 5 [0060.541] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0060.541] lstrlenW (lpString=".ppt") returned 4 [0060.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.541] lstrlenW (lpString=".zip") returned 4 [0060.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.541] lstrlenW (lpString=".rar") returned 4 [0060.541] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.541] lstrlenW (lpString=".bz2") returned 4 [0060.541] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.542] lstrlenW (lpString=".7z") returned 3 [0060.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.542] lstrlenW (lpString=".dbf") returned 4 [0060.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.542] lstrlenW (lpString=".1cd") returned 4 [0060.542] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0060.542] lstrlenW (lpString=".jpg") returned 4 [0060.542] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.542] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.542] lstrlenW (lpString="numbers.xml") returned 11 [0060.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0061.291] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=209) returned 1 [0061.291] CloseHandle (hObject=0x1cc) returned 1 [0061.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0061.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.291] lstrlenW (lpString=".doc") returned 4 [0061.292] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString=".docx") returned 5 [0061.292] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0061.292] lstrlenW (lpString=".pdf") returned 4 [0061.292] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString=".xls") returned 4 [0061.292] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString=".xlsx") returned 5 [0061.292] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0061.292] lstrlenW (lpString=".ppt") returned 4 [0061.292] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.292] lstrlenW (lpString=".zip") returned 4 [0061.292] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.292] lstrlenW (lpString=".rar") returned 4 [0061.292] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString=".bz2") returned 4 [0061.292] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString=".7z") returned 3 [0061.292] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.292] lstrlenW (lpString=".dbf") returned 4 [0061.292] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.292] lstrlenW (lpString=".1cd") returned 4 [0061.292] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.292] lstrlenW (lpString=".jpg") returned 4 [0061.292] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.293] lstrlenW (lpString=".doc") returned 4 [0061.293] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString=".docx") returned 5 [0061.293] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0061.293] lstrlenW (lpString=".pdf") returned 4 [0061.293] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString=".xls") returned 4 [0061.293] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString=".xlsx") returned 5 [0061.293] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0061.293] lstrlenW (lpString=".ppt") returned 4 [0061.293] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.293] lstrlenW (lpString=".zip") returned 4 [0061.293] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.293] lstrlenW (lpString=".rar") returned 4 [0061.293] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString=".bz2") returned 4 [0061.293] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString=".7z") returned 3 [0061.293] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.293] lstrlenW (lpString=".dbf") returned 4 [0061.293] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.293] lstrlenW (lpString=".1cd") returned 4 [0061.293] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0061.293] lstrlenW (lpString=".jpg") returned 4 [0061.294] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.294] lstrcmpiW (lpString1=".HTM", lpString2=".beets") returned 1 [0061.294] lstrlenW (lpString="README.HTM") returned 10 [0061.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0061.674] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1941) returned 1 [0061.674] CloseHandle (hObject=0x1cc) returned 1 [0061.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0061.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0061.676] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.676] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.677] GetLastError () returned 0x0 [0061.677] ReadFile (in: hFile=0x1cc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x795, lpOverlapped=0x0) returned 1 [0061.937] WriteFile (in: hFile=0x1d0, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0061.938] ReadFile (in: hFile=0x1cc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.938] WriteFile (in: hFile=0x1d0, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.938] SetEndOfFile (hFile=0x1d0) returned 1 [0061.938] CloseHandle (hObject=0x1d0) returned 1 [0061.941] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.941] SetEndOfFile (hFile=0x1cc) returned 1 [0061.942] CloseHandle (hObject=0x1cc) returned 1 [0061.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0061.943] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0061.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.943] lstrlenW (lpString=".doc") returned 4 [0061.943] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0061.943] lstrlenW (lpString=".docx") returned 5 [0061.943] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0061.943] lstrlenW (lpString=".pdf") returned 4 [0061.943] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0061.943] lstrlenW (lpString=".xls") returned 4 [0061.943] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0061.943] lstrlenW (lpString=".xlsx") returned 5 [0061.944] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0061.944] lstrlenW (lpString=".ppt") returned 4 [0061.944] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.944] lstrlenW (lpString=".zip") returned 4 [0061.944] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0061.944] lstrlenW (lpString=".rar") returned 4 [0061.944] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0061.944] lstrlenW (lpString=".bz2") returned 4 [0061.944] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0061.944] lstrlenW (lpString=".7z") returned 3 [0061.944] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.944] lstrlenW (lpString=".dbf") returned 4 [0061.944] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.944] lstrlenW (lpString=".1cd") returned 4 [0061.944] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.944] lstrlenW (lpString=".jpg") returned 4 [0061.945] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0061.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.945] lstrlenW (lpString=".doc") returned 4 [0061.945] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0061.945] lstrlenW (lpString=".docx") returned 5 [0061.945] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0061.945] lstrlenW (lpString=".pdf") returned 4 [0061.945] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0061.945] lstrlenW (lpString=".xls") returned 4 [0061.945] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0061.945] lstrlenW (lpString=".xlsx") returned 5 [0061.945] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0061.945] lstrlenW (lpString=".ppt") returned 4 [0061.945] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0061.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.945] lstrlenW (lpString=".zip") returned 4 [0061.945] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0061.945] lstrlenW (lpString=".rar") returned 4 [0061.945] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0061.945] lstrlenW (lpString=".bz2") returned 4 [0061.945] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0061.945] lstrlenW (lpString=".7z") returned 3 [0061.945] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0061.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.946] lstrlenW (lpString=".dbf") returned 4 [0061.946] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0061.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.946] lstrlenW (lpString=".1cd") returned 4 [0061.946] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0061.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0061.946] lstrlenW (lpString=".jpg") returned 4 [0061.946] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0061.946] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0061.946] lstrlenW (lpString="SETUP.XML") returned 9 [0061.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.196] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=2296) returned 1 [0066.196] CloseHandle (hObject=0x190) returned 1 [0066.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0066.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0066.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.196] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.196] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0067.461] GetLastError () returned 0x0 [0067.461] ReadFile (in: hFile=0x190, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0067.611] WriteFile (in: hFile=0x1c4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x900, lpOverlapped=0x0) returned 1 [0067.612] ReadFile (in: hFile=0x190, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.612] WriteFile (in: hFile=0x1c4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0067.612] SetEndOfFile (hFile=0x1c4) returned 1 [0067.612] CloseHandle (hObject=0x1c4) returned 1 [0067.613] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.613] SetEndOfFile (hFile=0x190) returned 1 [0067.614] CloseHandle (hObject=0x190) returned 1 [0067.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0067.614] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0067.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.615] lstrlenW (lpString=".doc") returned 4 [0067.615] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.615] lstrlenW (lpString=".docx") returned 5 [0067.615] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0067.615] lstrlenW (lpString=".pdf") returned 4 [0067.615] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.615] lstrlenW (lpString=".xls") returned 4 [0067.615] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.615] lstrlenW (lpString=".xlsx") returned 5 [0067.615] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0067.615] lstrlenW (lpString=".ppt") returned 4 [0067.615] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.615] lstrlenW (lpString=".zip") returned 4 [0067.615] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.615] lstrlenW (lpString=".rar") returned 4 [0067.615] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.615] lstrlenW (lpString=".bz2") returned 4 [0067.615] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.615] lstrlenW (lpString=".7z") returned 3 [0067.615] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.615] lstrlenW (lpString=".dbf") returned 4 [0067.615] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.615] lstrlenW (lpString=".1cd") returned 4 [0067.615] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.615] lstrlenW (lpString=".jpg") returned 4 [0067.616] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.616] lstrlenW (lpString=".doc") returned 4 [0067.616] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString=".docx") returned 5 [0067.616] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0067.616] lstrlenW (lpString=".pdf") returned 4 [0067.616] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString=".xls") returned 4 [0067.616] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString=".xlsx") returned 5 [0067.616] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0067.616] lstrlenW (lpString=".ppt") returned 4 [0067.616] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.616] lstrlenW (lpString=".zip") returned 4 [0067.616] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.616] lstrlenW (lpString=".rar") returned 4 [0067.616] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString=".bz2") returned 4 [0067.616] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString=".7z") returned 3 [0067.616] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.616] lstrlenW (lpString=".dbf") returned 4 [0067.616] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.616] lstrlenW (lpString=".1cd") returned 4 [0067.616] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0067.616] lstrlenW (lpString=".jpg") returned 4 [0067.616] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.616] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0067.617] lstrlenW (lpString="BRANDING.XML") returned 12 [0067.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0067.656] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=596341) returned 1 [0067.656] CloseHandle (hObject=0x20c) returned 1 [0067.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0067.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0067.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0067.656] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.656] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.657] GetLastError () returned 0x0 [0067.657] ReadFile (in: hFile=0x20c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x91975, lpOverlapped=0x0) returned 1 [0068.533] WriteFile (in: hFile=0x190, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0068.834] ReadFile (in: hFile=0x20c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.834] WriteFile (in: hFile=0x190, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.834] SetEndOfFile (hFile=0x190) returned 1 [0068.834] CloseHandle (hObject=0x190) returned 1 [0068.840] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.840] SetEndOfFile (hFile=0x20c) returned 1 [0068.843] CloseHandle (hObject=0x20c) returned 1 [0068.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0068.843] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0068.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.843] lstrlenW (lpString=".doc") returned 4 [0068.843] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.843] lstrlenW (lpString=".docx") returned 5 [0068.843] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0068.843] lstrlenW (lpString=".pdf") returned 4 [0068.843] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.843] lstrlenW (lpString=".xls") returned 4 [0068.844] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.844] lstrlenW (lpString=".xlsx") returned 5 [0068.844] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0068.844] lstrlenW (lpString=".ppt") returned 4 [0068.844] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.844] lstrlenW (lpString=".zip") returned 4 [0068.844] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.844] lstrlenW (lpString=".rar") returned 4 [0068.844] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.844] lstrlenW (lpString=".bz2") returned 4 [0068.844] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.844] lstrlenW (lpString=".7z") returned 3 [0068.844] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.844] lstrlenW (lpString=".dbf") returned 4 [0068.844] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.844] lstrlenW (lpString=".1cd") returned 4 [0068.844] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.844] lstrlenW (lpString=".jpg") returned 4 [0068.845] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.845] lstrlenW (lpString=".doc") returned 4 [0068.845] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.845] lstrlenW (lpString=".docx") returned 5 [0068.845] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0068.845] lstrlenW (lpString=".pdf") returned 4 [0068.845] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.845] lstrlenW (lpString=".xls") returned 4 [0068.845] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.845] lstrlenW (lpString=".xlsx") returned 5 [0068.845] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0068.845] lstrlenW (lpString=".ppt") returned 4 [0068.845] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.845] lstrlenW (lpString=".zip") returned 4 [0068.845] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.845] lstrlenW (lpString=".rar") returned 4 [0068.846] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.846] lstrlenW (lpString=".bz2") returned 4 [0068.846] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.846] lstrlenW (lpString=".7z") returned 3 [0068.846] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.846] lstrlenW (lpString=".dbf") returned 4 [0068.846] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.846] lstrlenW (lpString=".1cd") returned 4 [0068.846] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0068.846] lstrlenW (lpString=".jpg") returned 4 [0068.846] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.846] lstrcmpiW (lpString1=".CHM", lpString2=".beets") returned 1 [0068.846] lstrlenW (lpString="PSS10R.CHM") returned 10 [0068.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.848] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=27195) returned 1 [0068.848] CloseHandle (hObject=0x20c) returned 1 [0068.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0068.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0068.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.849] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.849] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0068.850] GetLastError () returned 0x0 [0068.850] ReadFile (in: hFile=0x20c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0069.110] WriteFile (in: hFile=0x190, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0069.111] ReadFile (in: hFile=0x20c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.111] WriteFile (in: hFile=0x190, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.112] SetEndOfFile (hFile=0x190) returned 1 [0069.599] CloseHandle (hObject=0x190) returned 1 [0069.600] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.600] SetEndOfFile (hFile=0x20c) returned 1 [0069.601] CloseHandle (hObject=0x20c) returned 1 [0069.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0069.601] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0069.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.837] lstrlenW (lpString=".doc") returned 4 [0069.837] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.837] lstrlenW (lpString=".docx") returned 5 [0069.837] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0069.837] lstrlenW (lpString=".pdf") returned 4 [0069.837] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.837] lstrlenW (lpString=".xls") returned 4 [0069.837] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.837] lstrlenW (lpString=".xlsx") returned 5 [0069.837] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0069.838] lstrlenW (lpString=".ppt") returned 4 [0069.838] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.838] lstrlenW (lpString=".zip") returned 4 [0069.838] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.838] lstrlenW (lpString=".rar") returned 4 [0069.838] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.838] lstrlenW (lpString=".bz2") returned 4 [0069.838] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.838] lstrlenW (lpString=".7z") returned 3 [0069.838] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.838] lstrlenW (lpString=".dbf") returned 4 [0069.838] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.838] lstrlenW (lpString=".1cd") returned 4 [0069.838] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.838] lstrlenW (lpString=".jpg") returned 4 [0069.838] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.838] lstrlenW (lpString=".doc") returned 4 [0069.838] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.838] lstrlenW (lpString=".docx") returned 5 [0069.838] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0069.838] lstrlenW (lpString=".pdf") returned 4 [0069.838] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.838] lstrlenW (lpString=".xls") returned 4 [0069.839] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.839] lstrlenW (lpString=".xlsx") returned 5 [0069.839] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0069.839] lstrlenW (lpString=".ppt") returned 4 [0069.839] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.839] lstrlenW (lpString=".zip") returned 4 [0069.839] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.839] lstrlenW (lpString=".rar") returned 4 [0069.839] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.839] lstrlenW (lpString=".bz2") returned 4 [0069.839] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.839] lstrlenW (lpString=".7z") returned 3 [0069.839] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.839] lstrlenW (lpString=".dbf") returned 4 [0069.839] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.839] lstrlenW (lpString=".1cd") returned 4 [0069.839] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0069.839] lstrlenW (lpString=".jpg") returned 4 [0069.839] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.840] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.840] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0069.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0069.840] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1606) returned 1 [0069.840] CloseHandle (hObject=0x1b4) returned 1 [0069.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0069.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0069.840] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.841] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.042] GetLastError () returned 0x0 [0070.042] ReadFile (in: hFile=0x1b4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x646, lpOverlapped=0x0) returned 1 [0070.124] WriteFile (in: hFile=0x1cc, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x650, lpOverlapped=0x0) returned 1 [0070.125] ReadFile (in: hFile=0x1b4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.125] WriteFile (in: hFile=0x1cc, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0070.125] SetEndOfFile (hFile=0x1cc) returned 1 [0070.125] CloseHandle (hObject=0x1cc) returned 1 [0070.125] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.125] SetEndOfFile (hFile=0x1b4) returned 1 [0070.126] CloseHandle (hObject=0x1b4) returned 1 [0070.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.126] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.127] lstrlenW (lpString=".doc") returned 4 [0070.127] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.127] lstrlenW (lpString=".docx") returned 5 [0070.127] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.127] lstrlenW (lpString=".pdf") returned 4 [0070.127] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.127] lstrlenW (lpString=".xls") returned 4 [0070.127] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.127] lstrlenW (lpString=".xlsx") returned 5 [0070.127] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.127] lstrlenW (lpString=".ppt") returned 4 [0070.127] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.127] lstrlenW (lpString=".zip") returned 4 [0070.127] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.127] lstrlenW (lpString=".rar") returned 4 [0070.127] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.127] lstrlenW (lpString=".bz2") returned 4 [0070.127] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.127] lstrlenW (lpString=".7z") returned 3 [0070.127] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.127] lstrlenW (lpString=".dbf") returned 4 [0070.127] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.127] lstrlenW (lpString=".1cd") returned 4 [0070.127] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.127] lstrlenW (lpString=".jpg") returned 4 [0070.127] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.128] lstrlenW (lpString=".doc") returned 4 [0070.128] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString=".docx") returned 5 [0070.128] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.128] lstrlenW (lpString=".pdf") returned 4 [0070.128] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString=".xls") returned 4 [0070.128] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString=".xlsx") returned 5 [0070.128] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.128] lstrlenW (lpString=".ppt") returned 4 [0070.128] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.128] lstrlenW (lpString=".zip") returned 4 [0070.128] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.128] lstrlenW (lpString=".rar") returned 4 [0070.128] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString=".bz2") returned 4 [0070.128] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString=".7z") returned 3 [0070.128] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.128] lstrlenW (lpString=".dbf") returned 4 [0070.128] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.128] lstrlenW (lpString=".1cd") returned 4 [0070.128] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0070.128] lstrlenW (lpString=".jpg") returned 4 [0070.128] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.128] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.129] lstrlenW (lpString="SETUP.XML") returned 9 [0070.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.212] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1886) returned 1 [0070.212] CloseHandle (hObject=0x1cc) returned 1 [0070.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0070.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.212] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.212] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.212] GetLastError () returned 0x0 [0070.212] ReadFile (in: hFile=0x1cc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x75e, lpOverlapped=0x0) returned 1 [0070.393] WriteFile (in: hFile=0x1a4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x760, lpOverlapped=0x0) returned 1 [0070.394] ReadFile (in: hFile=0x1cc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.394] WriteFile (in: hFile=0x1a4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.394] SetEndOfFile (hFile=0x1a4) returned 1 [0070.394] CloseHandle (hObject=0x1a4) returned 1 [0070.394] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.394] SetEndOfFile (hFile=0x1cc) returned 1 [0070.395] CloseHandle (hObject=0x1cc) returned 1 [0070.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.395] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0070.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.396] lstrlenW (lpString=".doc") returned 4 [0070.396] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.396] lstrlenW (lpString=".docx") returned 5 [0070.396] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.396] lstrlenW (lpString=".pdf") returned 4 [0070.396] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.396] lstrlenW (lpString=".xls") returned 4 [0070.396] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.396] lstrlenW (lpString=".xlsx") returned 5 [0070.396] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.396] lstrlenW (lpString=".ppt") returned 4 [0070.396] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.396] lstrlenW (lpString=".zip") returned 4 [0070.396] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.396] lstrlenW (lpString=".rar") returned 4 [0070.396] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.396] lstrlenW (lpString=".bz2") returned 4 [0070.396] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.396] lstrlenW (lpString=".7z") returned 3 [0070.396] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.396] lstrlenW (lpString=".dbf") returned 4 [0070.396] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.396] lstrlenW (lpString=".1cd") returned 4 [0070.396] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.397] lstrlenW (lpString=".jpg") returned 4 [0070.397] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.397] lstrlenW (lpString=".doc") returned 4 [0070.397] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.397] lstrlenW (lpString=".docx") returned 5 [0070.397] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.397] lstrlenW (lpString=".pdf") returned 4 [0070.397] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.397] lstrlenW (lpString=".xls") returned 4 [0070.397] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.397] lstrlenW (lpString=".xlsx") returned 5 [0070.397] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.397] lstrlenW (lpString=".ppt") returned 4 [0070.397] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.397] lstrlenW (lpString=".zip") returned 4 [0070.397] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.397] lstrlenW (lpString=".rar") returned 4 [0070.397] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.397] lstrlenW (lpString=".bz2") returned 4 [0070.397] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.397] lstrlenW (lpString=".7z") returned 3 [0070.397] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.397] lstrlenW (lpString=".dbf") returned 4 [0070.398] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.398] lstrlenW (lpString=".1cd") returned 4 [0070.398] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0070.398] lstrlenW (lpString=".jpg") returned 4 [0070.398] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.398] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.398] lstrlenW (lpString="SETUP.XML") returned 9 [0070.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.530] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1872) returned 1 [0070.530] CloseHandle (hObject=0x1a4) returned 1 [0070.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0070.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.531] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.531] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0070.531] GetLastError () returned 0x0 [0070.531] ReadFile (in: hFile=0x1a4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x750, lpOverlapped=0x0) returned 1 [0070.631] WriteFile (in: hFile=0x1b4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x760, lpOverlapped=0x0) returned 1 [0070.734] ReadFile (in: hFile=0x1a4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.734] WriteFile (in: hFile=0x1b4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.734] SetEndOfFile (hFile=0x1b4) returned 1 [0070.734] CloseHandle (hObject=0x1b4) returned 1 [0070.734] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.734] SetEndOfFile (hFile=0x1a4) returned 1 [0070.735] CloseHandle (hObject=0x1a4) returned 1 [0070.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.735] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0070.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.736] lstrlenW (lpString=".doc") returned 4 [0070.736] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString=".docx") returned 5 [0070.736] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.736] lstrlenW (lpString=".pdf") returned 4 [0070.736] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString=".xls") returned 4 [0070.736] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString=".xlsx") returned 5 [0070.736] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.736] lstrlenW (lpString=".ppt") returned 4 [0070.736] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.736] lstrlenW (lpString=".zip") returned 4 [0070.736] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.736] lstrlenW (lpString=".rar") returned 4 [0070.736] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString=".bz2") returned 4 [0070.736] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString=".7z") returned 3 [0070.736] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.736] lstrlenW (lpString=".dbf") returned 4 [0070.736] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.736] lstrlenW (lpString=".1cd") returned 4 [0070.736] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.736] lstrlenW (lpString=".jpg") returned 4 [0070.736] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.736] lstrlenW (lpString=".doc") returned 4 [0070.736] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.736] lstrlenW (lpString=".docx") returned 5 [0070.737] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.737] lstrlenW (lpString=".pdf") returned 4 [0070.737] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.737] lstrlenW (lpString=".xls") returned 4 [0070.737] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.737] lstrlenW (lpString=".xlsx") returned 5 [0070.737] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.737] lstrlenW (lpString=".ppt") returned 4 [0070.737] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.737] lstrlenW (lpString=".zip") returned 4 [0070.737] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.737] lstrlenW (lpString=".rar") returned 4 [0070.737] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.737] lstrlenW (lpString=".bz2") returned 4 [0070.737] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.737] lstrlenW (lpString=".7z") returned 3 [0070.737] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.737] lstrlenW (lpString=".dbf") returned 4 [0070.737] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.737] lstrlenW (lpString=".1cd") returned 4 [0070.737] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0070.737] lstrlenW (lpString=".jpg") returned 4 [0070.737] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.737] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.737] lstrlenW (lpString="Proof.XML") returned 9 [0070.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0070.782] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1457) returned 1 [0070.782] CloseHandle (hObject=0x1d0) returned 1 [0070.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0070.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0070.782] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.782] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0070.782] GetLastError () returned 0x0 [0070.782] ReadFile (in: hFile=0x1d0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0070.923] WriteFile (in: hFile=0x1b4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0070.924] ReadFile (in: hFile=0x1d0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.924] WriteFile (in: hFile=0x1b4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.924] SetEndOfFile (hFile=0x1b4) returned 1 [0070.924] CloseHandle (hObject=0x1b4) returned 1 [0070.924] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.924] SetEndOfFile (hFile=0x1d0) returned 1 [0070.925] CloseHandle (hObject=0x1d0) returned 1 [0070.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.925] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0070.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.926] lstrlenW (lpString=".doc") returned 4 [0070.926] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.926] lstrlenW (lpString=".docx") returned 5 [0070.926] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0070.926] lstrlenW (lpString=".pdf") returned 4 [0070.926] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.926] lstrlenW (lpString=".xls") returned 4 [0070.926] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.926] lstrlenW (lpString=".xlsx") returned 5 [0070.926] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0070.926] lstrlenW (lpString=".ppt") returned 4 [0070.926] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.926] lstrlenW (lpString=".zip") returned 4 [0070.926] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.926] lstrlenW (lpString=".rar") returned 4 [0070.926] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.926] lstrlenW (lpString=".bz2") returned 4 [0070.926] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.926] lstrlenW (lpString=".7z") returned 3 [0070.926] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.926] lstrlenW (lpString=".dbf") returned 4 [0070.926] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.927] lstrlenW (lpString=".1cd") returned 4 [0070.927] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.927] lstrlenW (lpString=".jpg") returned 4 [0070.927] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.927] lstrlenW (lpString=".doc") returned 4 [0070.927] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.927] lstrlenW (lpString=".docx") returned 5 [0070.927] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0070.927] lstrlenW (lpString=".pdf") returned 4 [0070.927] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.927] lstrlenW (lpString=".xls") returned 4 [0070.927] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.927] lstrlenW (lpString=".xlsx") returned 5 [0070.927] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0070.927] lstrlenW (lpString=".ppt") returned 4 [0070.927] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.928] lstrlenW (lpString=".zip") returned 4 [0070.928] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.928] lstrlenW (lpString=".rar") returned 4 [0070.928] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.928] lstrlenW (lpString=".bz2") returned 4 [0070.928] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.928] lstrlenW (lpString=".7z") returned 3 [0070.928] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.928] lstrlenW (lpString=".dbf") returned 4 [0070.928] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.928] lstrlenW (lpString=".1cd") returned 4 [0070.928] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0070.928] lstrlenW (lpString=".jpg") returned 4 [0070.928] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.928] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.928] lstrlenW (lpString="Proofing.XML") returned 12 [0070.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.958] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=811) returned 1 [0070.958] CloseHandle (hObject=0x1a4) returned 1 [0070.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0070.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.958] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.958] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0070.959] GetLastError () returned 0x0 [0070.959] ReadFile (in: hFile=0x1a4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x32b, lpOverlapped=0x0) returned 1 [0071.000] WriteFile (in: hFile=0x1d0, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x330, lpOverlapped=0x0) returned 1 [0071.001] ReadFile (in: hFile=0x1a4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.001] WriteFile (in: hFile=0x1d0, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.001] SetEndOfFile (hFile=0x1d0) returned 1 [0071.186] CloseHandle (hObject=0x1d0) returned 1 [0071.186] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.186] SetEndOfFile (hFile=0x1a4) returned 1 [0071.187] CloseHandle (hObject=0x1a4) returned 1 [0071.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.187] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0071.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.187] lstrlenW (lpString=".doc") returned 4 [0071.187] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.187] lstrlenW (lpString=".docx") returned 5 [0071.187] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0071.187] lstrlenW (lpString=".pdf") returned 4 [0071.187] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.187] lstrlenW (lpString=".xls") returned 4 [0071.187] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.187] lstrlenW (lpString=".xlsx") returned 5 [0071.187] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0071.187] lstrlenW (lpString=".ppt") returned 4 [0071.187] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.187] lstrlenW (lpString=".zip") returned 4 [0071.187] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.187] lstrlenW (lpString=".rar") returned 4 [0071.187] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString=".bz2") returned 4 [0071.188] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString=".7z") returned 3 [0071.188] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.188] lstrlenW (lpString=".dbf") returned 4 [0071.188] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.188] lstrlenW (lpString=".1cd") returned 4 [0071.188] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.188] lstrlenW (lpString=".jpg") returned 4 [0071.188] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.188] lstrlenW (lpString=".doc") returned 4 [0071.188] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString=".docx") returned 5 [0071.188] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0071.188] lstrlenW (lpString=".pdf") returned 4 [0071.188] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString=".xls") returned 4 [0071.188] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString=".xlsx") returned 5 [0071.188] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0071.188] lstrlenW (lpString=".ppt") returned 4 [0071.188] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.188] lstrlenW (lpString=".zip") returned 4 [0071.188] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.188] lstrlenW (lpString=".rar") returned 4 [0071.188] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString=".bz2") returned 4 [0071.188] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString=".7z") returned 3 [0071.188] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.188] lstrlenW (lpString=".dbf") returned 4 [0071.188] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.189] lstrlenW (lpString=".1cd") returned 4 [0071.189] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0071.189] lstrlenW (lpString=".jpg") returned 4 [0071.189] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.189] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.189] lstrlenW (lpString="SETUP.XML") returned 9 [0071.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.191] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1608) returned 1 [0071.191] CloseHandle (hObject=0x1d0) returned 1 [0071.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0071.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.191] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.191] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0071.192] GetLastError () returned 0x0 [0071.192] ReadFile (in: hFile=0x1d0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x648, lpOverlapped=0x0) returned 1 [0071.303] WriteFile (in: hFile=0x1c4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x650, lpOverlapped=0x0) returned 1 [0071.304] ReadFile (in: hFile=0x1d0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.304] WriteFile (in: hFile=0x1c4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.304] SetEndOfFile (hFile=0x1c4) returned 1 [0071.304] CloseHandle (hObject=0x1c4) returned 1 [0071.305] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.305] SetEndOfFile (hFile=0x1d0) returned 1 [0071.306] CloseHandle (hObject=0x1d0) returned 1 [0071.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.306] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0071.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.306] lstrlenW (lpString=".doc") returned 4 [0071.306] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.306] lstrlenW (lpString=".docx") returned 5 [0071.306] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.306] lstrlenW (lpString=".pdf") returned 4 [0071.306] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.306] lstrlenW (lpString=".xls") returned 4 [0071.306] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.306] lstrlenW (lpString=".xlsx") returned 5 [0071.306] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.306] lstrlenW (lpString=".ppt") returned 4 [0071.307] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.307] lstrlenW (lpString=".zip") returned 4 [0071.307] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.307] lstrlenW (lpString=".rar") returned 4 [0071.307] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString=".bz2") returned 4 [0071.307] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString=".7z") returned 3 [0071.307] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.307] lstrlenW (lpString=".dbf") returned 4 [0071.307] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.307] lstrlenW (lpString=".1cd") returned 4 [0071.307] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.307] lstrlenW (lpString=".jpg") returned 4 [0071.307] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.307] lstrlenW (lpString=".doc") returned 4 [0071.307] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString=".docx") returned 5 [0071.307] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.307] lstrlenW (lpString=".pdf") returned 4 [0071.307] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString=".xls") returned 4 [0071.307] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.307] lstrlenW (lpString=".xlsx") returned 5 [0071.307] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.307] lstrlenW (lpString=".ppt") returned 4 [0071.307] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.308] lstrlenW (lpString=".zip") returned 4 [0071.308] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.308] lstrlenW (lpString=".rar") returned 4 [0071.308] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.308] lstrlenW (lpString=".bz2") returned 4 [0071.308] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.308] lstrlenW (lpString=".7z") returned 3 [0071.308] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.308] lstrlenW (lpString=".dbf") returned 4 [0071.308] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.308] lstrlenW (lpString=".1cd") returned 4 [0071.308] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0071.308] lstrlenW (lpString=".jpg") returned 4 [0071.308] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.308] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.308] lstrlenW (lpString="VisiorWW.XML") returned 12 [0071.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0071.355] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=8723) returned 1 [0071.355] CloseHandle (hObject=0x18c) returned 1 [0071.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0071.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0071.355] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.355] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0071.362] GetLastError () returned 0x0 [0071.362] ReadFile (in: hFile=0x18c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x2213, lpOverlapped=0x0) returned 1 [0071.572] WriteFile (in: hFile=0x214, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0071.573] ReadFile (in: hFile=0x18c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.573] WriteFile (in: hFile=0x214, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.573] SetEndOfFile (hFile=0x214) returned 1 [0071.575] CloseHandle (hObject=0x214) returned 1 [0071.575] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.575] SetEndOfFile (hFile=0x18c) returned 1 [0071.576] CloseHandle (hObject=0x18c) returned 1 [0071.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.577] lstrlenW (lpString=".doc") returned 4 [0071.577] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.577] lstrlenW (lpString=".docx") returned 5 [0071.577] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0071.577] lstrlenW (lpString=".pdf") returned 4 [0071.577] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.577] lstrlenW (lpString=".xls") returned 4 [0071.577] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.577] lstrlenW (lpString=".xlsx") returned 5 [0071.577] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0071.577] lstrlenW (lpString=".ppt") returned 4 [0071.577] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.577] lstrlenW (lpString=".zip") returned 4 [0071.577] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.577] lstrlenW (lpString=".rar") returned 4 [0071.577] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.577] lstrlenW (lpString=".bz2") returned 4 [0071.578] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.578] lstrlenW (lpString=".7z") returned 3 [0071.578] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.578] lstrlenW (lpString=".dbf") returned 4 [0071.578] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.578] lstrlenW (lpString=".1cd") returned 4 [0071.578] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.578] lstrlenW (lpString=".jpg") returned 4 [0071.578] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.578] lstrlenW (lpString=".doc") returned 4 [0071.578] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.578] lstrlenW (lpString=".docx") returned 5 [0071.578] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0071.578] lstrlenW (lpString=".pdf") returned 4 [0071.578] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.578] lstrlenW (lpString=".xls") returned 4 [0071.578] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.578] lstrlenW (lpString=".xlsx") returned 5 [0071.578] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0071.578] lstrlenW (lpString=".ppt") returned 4 [0071.578] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.578] lstrlenW (lpString=".zip") returned 4 [0071.578] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.579] lstrlenW (lpString=".rar") returned 4 [0071.579] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.579] lstrlenW (lpString=".bz2") returned 4 [0071.579] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.579] lstrlenW (lpString=".7z") returned 3 [0071.579] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.579] lstrlenW (lpString=".dbf") returned 4 [0071.579] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.579] lstrlenW (lpString=".1cd") returned 4 [0071.579] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0071.579] lstrlenW (lpString=".jpg") returned 4 [0071.579] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.579] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.579] lstrlenW (lpString="WordMUI.XML") returned 11 [0071.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0071.661] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=1800) returned 1 [0071.661] CloseHandle (hObject=0x214) returned 1 [0071.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0071.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0071.662] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.662] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0071.665] GetLastError () returned 0x0 [0071.665] ReadFile (in: hFile=0x214, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x708, lpOverlapped=0x0) returned 1 [0071.823] WriteFile (in: hFile=0x1c8, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x710, lpOverlapped=0x0) returned 1 [0071.824] ReadFile (in: hFile=0x214, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.824] WriteFile (in: hFile=0x1c8, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.824] SetEndOfFile (hFile=0x1c8) returned 1 [0071.824] CloseHandle (hObject=0x1c8) returned 1 [0071.825] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.825] SetEndOfFile (hFile=0x214) returned 1 [0071.826] CloseHandle (hObject=0x214) returned 1 [0071.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.826] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0071.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.827] lstrlenW (lpString=".doc") returned 4 [0071.827] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.827] lstrlenW (lpString=".docx") returned 5 [0071.827] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.827] lstrlenW (lpString=".pdf") returned 4 [0071.827] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.827] lstrlenW (lpString=".xls") returned 4 [0071.827] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.827] lstrlenW (lpString=".xlsx") returned 5 [0071.827] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.827] lstrlenW (lpString=".ppt") returned 4 [0071.827] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.827] lstrlenW (lpString=".zip") returned 4 [0071.827] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.827] lstrlenW (lpString=".rar") returned 4 [0071.827] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.827] lstrlenW (lpString=".bz2") returned 4 [0071.827] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.827] lstrlenW (lpString=".7z") returned 3 [0071.827] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.828] lstrlenW (lpString=".dbf") returned 4 [0071.828] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.828] lstrlenW (lpString=".1cd") returned 4 [0071.828] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.828] lstrlenW (lpString=".jpg") returned 4 [0071.828] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.828] lstrlenW (lpString=".doc") returned 4 [0071.828] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.828] lstrlenW (lpString=".docx") returned 5 [0071.828] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.828] lstrlenW (lpString=".pdf") returned 4 [0071.828] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.828] lstrlenW (lpString=".xls") returned 4 [0071.828] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.828] lstrlenW (lpString=".xlsx") returned 5 [0071.828] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.828] lstrlenW (lpString=".ppt") returned 4 [0071.828] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.828] lstrlenW (lpString=".zip") returned 4 [0071.828] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.828] lstrlenW (lpString=".rar") returned 4 [0071.828] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.829] lstrlenW (lpString=".bz2") returned 4 [0071.829] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.829] lstrlenW (lpString=".7z") returned 3 [0071.829] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.829] lstrlenW (lpString=".dbf") returned 4 [0071.829] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.829] lstrlenW (lpString=".1cd") returned 4 [0071.829] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0071.829] lstrlenW (lpString=".jpg") returned 4 [0071.829] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.829] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.829] lstrlenW (lpString="STOCKS.XML") returned 10 [0071.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.881] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=2687) returned 1 [0071.881] CloseHandle (hObject=0x180) returned 1 [0071.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0071.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.882] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.882] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.883] GetLastError () returned 0x0 [0071.883] ReadFile (in: hFile=0x180, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0071.895] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0071.896] ReadFile (in: hFile=0x180, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.896] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0071.896] SetEndOfFile (hFile=0x210) returned 1 [0071.896] CloseHandle (hObject=0x210) returned 1 [0071.896] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.896] SetEndOfFile (hFile=0x180) returned 1 [0071.897] CloseHandle (hObject=0x180) returned 1 [0071.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0071.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.899] lstrlenW (lpString=".doc") returned 4 [0071.899] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.899] lstrlenW (lpString=".docx") returned 5 [0071.899] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0071.899] lstrlenW (lpString=".pdf") returned 4 [0071.899] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.899] lstrlenW (lpString=".xls") returned 4 [0071.899] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.899] lstrlenW (lpString=".xlsx") returned 5 [0071.899] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0071.899] lstrlenW (lpString=".ppt") returned 4 [0071.899] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.899] lstrlenW (lpString=".zip") returned 4 [0071.899] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.899] lstrlenW (lpString=".rar") returned 4 [0071.899] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.899] lstrlenW (lpString=".bz2") returned 4 [0071.899] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.900] lstrlenW (lpString=".7z") returned 3 [0071.900] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.900] lstrlenW (lpString=".dbf") returned 4 [0071.900] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.900] lstrlenW (lpString=".1cd") returned 4 [0071.900] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.900] lstrlenW (lpString=".jpg") returned 4 [0071.900] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.900] lstrlenW (lpString=".doc") returned 4 [0071.900] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.900] lstrlenW (lpString=".docx") returned 5 [0071.900] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0071.900] lstrlenW (lpString=".pdf") returned 4 [0071.900] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.900] lstrlenW (lpString=".xls") returned 4 [0071.900] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.900] lstrlenW (lpString=".xlsx") returned 5 [0071.900] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0071.901] lstrlenW (lpString=".ppt") returned 4 [0071.901] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.901] lstrlenW (lpString=".zip") returned 4 [0071.901] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.901] lstrlenW (lpString=".rar") returned 4 [0071.901] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.901] lstrlenW (lpString=".bz2") returned 4 [0071.901] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.901] lstrlenW (lpString=".7z") returned 3 [0071.901] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.901] lstrlenW (lpString=".dbf") returned 4 [0071.901] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.901] lstrlenW (lpString=".1cd") returned 4 [0071.901] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0071.901] lstrlenW (lpString=".jpg") returned 4 [0071.901] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.901] lstrcmpiW (lpString1=".XSL", lpString2=".beets") returned 1 [0071.901] lstrlenW (lpString="BASMLA.XSL") returned 10 [0071.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.902] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=227311) returned 1 [0071.902] CloseHandle (hObject=0x180) returned 1 [0071.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0071.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.903] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.903] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.903] GetLastError () returned 0x0 [0071.903] ReadFile (in: hFile=0x180, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0072.029] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0072.034] ReadFile (in: hFile=0x180, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.034] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0072.034] SetEndOfFile (hFile=0x210) returned 1 [0072.034] CloseHandle (hObject=0x210) returned 1 [0072.035] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.035] SetEndOfFile (hFile=0x180) returned 1 [0072.036] CloseHandle (hObject=0x180) returned 1 [0072.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0072.036] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0072.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.036] lstrlenW (lpString=".doc") returned 4 [0072.036] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0072.036] lstrlenW (lpString=".docx") returned 5 [0072.036] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0072.037] lstrlenW (lpString=".pdf") returned 4 [0072.037] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString=".xls") returned 4 [0072.037] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString=".xlsx") returned 5 [0072.037] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0072.037] lstrlenW (lpString=".ppt") returned 4 [0072.037] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.037] lstrlenW (lpString=".zip") returned 4 [0072.037] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0072.037] lstrlenW (lpString=".rar") returned 4 [0072.037] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString=".bz2") returned 4 [0072.037] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString=".7z") returned 3 [0072.037] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0072.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.037] lstrlenW (lpString=".dbf") returned 4 [0072.037] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.037] lstrlenW (lpString=".1cd") returned 4 [0072.037] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.037] lstrlenW (lpString=".jpg") returned 4 [0072.037] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.037] lstrlenW (lpString=".doc") returned 4 [0072.037] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0072.037] lstrlenW (lpString=".docx") returned 5 [0072.037] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0072.037] lstrlenW (lpString=".pdf") returned 4 [0072.038] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0072.038] lstrlenW (lpString=".xls") returned 4 [0072.038] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0072.038] lstrlenW (lpString=".xlsx") returned 5 [0072.038] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0072.038] lstrlenW (lpString=".ppt") returned 4 [0072.038] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0072.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.038] lstrlenW (lpString=".zip") returned 4 [0072.038] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0072.038] lstrlenW (lpString=".rar") returned 4 [0072.038] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0072.038] lstrlenW (lpString=".bz2") returned 4 [0072.038] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0072.038] lstrlenW (lpString=".7z") returned 3 [0072.038] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0072.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.038] lstrlenW (lpString=".dbf") returned 4 [0072.038] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0072.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.038] lstrlenW (lpString=".1cd") returned 4 [0072.038] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0072.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0072.038] lstrlenW (lpString=".jpg") returned 4 [0072.038] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0072.038] lstrcmpiW (lpString1=".emf", lpString2=".beets") returned 1 [0072.038] lstrlenW (lpString="Genko_1.emf") returned 11 [0072.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.039] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=5524) returned 1 [0072.039] CloseHandle (hObject=0x180) returned 1 [0072.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0072.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.040] lstrlenW (lpString=".doc") returned 4 [0072.040] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.040] lstrlenW (lpString=".docx") returned 5 [0072.040] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0072.040] lstrlenW (lpString=".pdf") returned 4 [0072.040] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.040] lstrlenW (lpString=".xls") returned 4 [0072.040] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.040] lstrlenW (lpString=".xlsx") returned 5 [0072.040] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0072.040] lstrlenW (lpString=".ppt") returned 4 [0072.040] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.040] lstrlenW (lpString=".zip") returned 4 [0072.040] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.040] lstrlenW (lpString=".rar") returned 4 [0072.040] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.040] lstrlenW (lpString=".bz2") returned 4 [0072.040] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.040] lstrlenW (lpString=".7z") returned 3 [0072.040] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.040] lstrlenW (lpString=".dbf") returned 4 [0072.041] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.041] lstrlenW (lpString=".1cd") returned 4 [0072.041] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0072.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.041] lstrlenW (lpString=".jpg") returned 4 [0072.041] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0072.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.041] lstrlenW (lpString=".doc") returned 4 [0072.041] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.041] lstrlenW (lpString=".docx") returned 5 [0072.041] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0072.041] lstrlenW (lpString=".pdf") returned 4 [0072.041] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.041] lstrlenW (lpString=".xls") returned 4 [0072.041] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.041] lstrlenW (lpString=".xlsx") returned 5 [0072.041] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0072.041] lstrlenW (lpString=".ppt") returned 4 [0072.041] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.041] lstrlenW (lpString=".zip") returned 4 [0072.041] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.042] lstrlenW (lpString=".rar") returned 4 [0072.042] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.042] lstrlenW (lpString=".bz2") returned 4 [0072.042] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.042] lstrlenW (lpString=".7z") returned 3 [0072.042] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.042] lstrlenW (lpString=".dbf") returned 4 [0072.042] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.042] lstrlenW (lpString=".1cd") returned 4 [0072.042] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0072.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0072.042] lstrlenW (lpString=".jpg") returned 4 [0072.042] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0072.042] lstrcmpiW (lpString1=".emf", lpString2=".beets") returned 1 [0072.042] lstrlenW (lpString="Genko_2.emf") returned 11 [0072.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.042] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=10340) returned 1 [0072.042] CloseHandle (hObject=0x180) returned 1 [0072.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0072.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.043] lstrlenW (lpString=".doc") returned 4 [0072.043] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.043] lstrlenW (lpString=".docx") returned 5 [0072.043] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0072.043] lstrlenW (lpString=".pdf") returned 4 [0072.043] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.043] lstrlenW (lpString=".xls") returned 4 [0072.043] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.043] lstrlenW (lpString=".xlsx") returned 5 [0072.043] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0072.043] lstrlenW (lpString=".ppt") returned 4 [0072.043] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.043] lstrlenW (lpString=".zip") returned 4 [0072.043] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.043] lstrlenW (lpString=".rar") returned 4 [0072.043] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.043] lstrlenW (lpString=".bz2") returned 4 [0072.043] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.043] lstrlenW (lpString=".7z") returned 3 [0072.044] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.044] lstrlenW (lpString=".dbf") returned 4 [0072.044] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.044] lstrlenW (lpString=".1cd") returned 4 [0072.044] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0072.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.044] lstrlenW (lpString=".jpg") returned 4 [0072.044] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0072.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.044] lstrlenW (lpString=".doc") returned 4 [0072.044] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.044] lstrlenW (lpString=".docx") returned 5 [0072.044] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0072.044] lstrlenW (lpString=".pdf") returned 4 [0072.044] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.044] lstrlenW (lpString=".xls") returned 4 [0072.044] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.044] lstrlenW (lpString=".xlsx") returned 5 [0072.044] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0072.044] lstrlenW (lpString=".ppt") returned 4 [0072.044] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.044] lstrlenW (lpString=".zip") returned 4 [0072.044] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.044] lstrlenW (lpString=".rar") returned 4 [0072.044] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.044] lstrlenW (lpString=".bz2") returned 4 [0072.044] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.044] lstrlenW (lpString=".7z") returned 3 [0072.044] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.044] lstrlenW (lpString=".dbf") returned 4 [0072.045] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.045] lstrlenW (lpString=".1cd") returned 4 [0072.045] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0072.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0072.045] lstrlenW (lpString=".jpg") returned 4 [0072.045] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0072.045] lstrcmpiW (lpString1=".emf", lpString2=".beets") returned 1 [0072.045] lstrlenW (lpString="Graph.emf") returned 9 [0072.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0072.505] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=116724) returned 1 [0072.505] CloseHandle (hObject=0x184) returned 1 [0072.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0072.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.505] lstrlenW (lpString=".doc") returned 4 [0072.505] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.505] lstrlenW (lpString=".docx") returned 5 [0072.506] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0072.506] lstrlenW (lpString=".pdf") returned 4 [0072.506] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.506] lstrlenW (lpString=".xls") returned 4 [0072.506] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.506] lstrlenW (lpString=".xlsx") returned 5 [0072.506] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0072.506] lstrlenW (lpString=".ppt") returned 4 [0072.506] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.506] lstrlenW (lpString=".zip") returned 4 [0072.506] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.506] lstrlenW (lpString=".rar") returned 4 [0072.506] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.506] lstrlenW (lpString=".bz2") returned 4 [0072.506] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.506] lstrlenW (lpString=".7z") returned 3 [0072.506] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.506] lstrlenW (lpString=".dbf") returned 4 [0072.506] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.506] lstrlenW (lpString=".1cd") returned 4 [0072.506] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0072.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.506] lstrlenW (lpString=".jpg") returned 4 [0072.506] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.507] lstrlenW (lpString=".doc") returned 4 [0072.507] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.507] lstrlenW (lpString=".docx") returned 5 [0072.507] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0072.507] lstrlenW (lpString=".pdf") returned 4 [0072.507] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.507] lstrlenW (lpString=".xls") returned 4 [0072.507] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.507] lstrlenW (lpString=".xlsx") returned 5 [0072.507] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0072.507] lstrlenW (lpString=".ppt") returned 4 [0072.507] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.507] lstrlenW (lpString=".zip") returned 4 [0072.507] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.507] lstrlenW (lpString=".rar") returned 4 [0072.507] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.507] lstrlenW (lpString=".bz2") returned 4 [0072.507] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.507] lstrlenW (lpString=".7z") returned 3 [0072.507] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.507] lstrlenW (lpString=".dbf") returned 4 [0072.507] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.507] lstrlenW (lpString=".1cd") returned 4 [0072.507] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0072.507] lstrlenW (lpString=".jpg") returned 4 [0072.508] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0072.508] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.508] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0072.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0072.508] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=3981) returned 1 [0072.508] CloseHandle (hObject=0x184) returned 1 [0072.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0072.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.509] lstrlenW (lpString=".doc") returned 4 [0072.509] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.509] lstrlenW (lpString=".docx") returned 5 [0072.509] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0072.509] lstrlenW (lpString=".pdf") returned 4 [0072.509] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.509] lstrlenW (lpString=".xls") returned 4 [0072.509] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.509] lstrlenW (lpString=".xlsx") returned 5 [0072.509] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0072.509] lstrlenW (lpString=".ppt") returned 4 [0072.509] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.509] lstrlenW (lpString=".zip") returned 4 [0072.509] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.509] lstrlenW (lpString=".rar") returned 4 [0072.509] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.509] lstrlenW (lpString=".bz2") returned 4 [0072.509] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.510] lstrlenW (lpString=".7z") returned 3 [0072.510] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.510] lstrlenW (lpString=".dbf") returned 4 [0072.510] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.510] lstrlenW (lpString=".1cd") returned 4 [0072.510] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.510] lstrlenW (lpString=".jpg") returned 4 [0072.510] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.510] lstrlenW (lpString=".doc") returned 4 [0072.510] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.510] lstrlenW (lpString=".docx") returned 5 [0072.510] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0072.510] lstrlenW (lpString=".pdf") returned 4 [0072.510] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.510] lstrlenW (lpString=".xls") returned 4 [0072.510] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.510] lstrlenW (lpString=".xlsx") returned 5 [0072.510] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0072.510] lstrlenW (lpString=".ppt") returned 4 [0072.510] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.510] lstrlenW (lpString=".zip") returned 4 [0072.510] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.510] lstrlenW (lpString=".rar") returned 4 [0072.510] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.511] lstrlenW (lpString=".bz2") returned 4 [0072.511] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.511] lstrlenW (lpString=".7z") returned 3 [0072.511] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.511] lstrlenW (lpString=".dbf") returned 4 [0072.511] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.511] lstrlenW (lpString=".1cd") returned 4 [0072.511] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0072.511] lstrlenW (lpString=".jpg") returned 4 [0072.511] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.511] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.511] lstrlenW (lpString="Pretty_Peacock.jpg") returned 18 [0072.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0072.511] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=5115) returned 1 [0072.512] CloseHandle (hObject=0x184) returned 1 [0072.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0072.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.512] lstrlenW (lpString=".doc") returned 4 [0072.512] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.512] lstrlenW (lpString=".docx") returned 5 [0072.512] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0072.512] lstrlenW (lpString=".pdf") returned 4 [0072.512] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.512] lstrlenW (lpString=".xls") returned 4 [0072.512] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.512] lstrlenW (lpString=".xlsx") returned 5 [0072.512] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0072.512] lstrlenW (lpString=".ppt") returned 4 [0072.512] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.512] lstrlenW (lpString=".zip") returned 4 [0072.512] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.512] lstrlenW (lpString=".rar") returned 4 [0072.513] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.513] lstrlenW (lpString=".bz2") returned 4 [0072.513] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.513] lstrlenW (lpString=".7z") returned 3 [0072.513] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.513] lstrlenW (lpString=".dbf") returned 4 [0072.513] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.513] lstrlenW (lpString=".1cd") returned 4 [0072.513] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.513] lstrlenW (lpString=".jpg") returned 4 [0072.513] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.513] lstrlenW (lpString=".doc") returned 4 [0072.513] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.513] lstrlenW (lpString=".docx") returned 5 [0072.513] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0072.513] lstrlenW (lpString=".pdf") returned 4 [0072.513] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.513] lstrlenW (lpString=".xls") returned 4 [0072.513] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.513] lstrlenW (lpString=".xlsx") returned 5 [0072.513] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0072.513] lstrlenW (lpString=".ppt") returned 4 [0072.513] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.513] lstrlenW (lpString=".zip") returned 4 [0072.514] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.514] lstrlenW (lpString=".rar") returned 4 [0072.514] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.514] lstrlenW (lpString=".bz2") returned 4 [0072.514] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.514] lstrlenW (lpString=".7z") returned 3 [0072.514] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.514] lstrlenW (lpString=".dbf") returned 4 [0072.514] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.514] lstrlenW (lpString=".1cd") returned 4 [0072.514] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0072.514] lstrlenW (lpString=".jpg") returned 4 [0072.514] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.514] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.515] lstrlenW (lpString="Psychedelic.jpg") returned 15 [0072.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0072.516] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=14049) returned 1 [0072.516] CloseHandle (hObject=0x184) returned 1 [0072.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0072.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0072.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0072.516] lstrlenW (lpString=".doc") returned 4 [0072.516] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.516] lstrlenW (lpString=".docx") returned 5 [0072.516] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1 [0072.516] lstrlenW (lpString=".pdf") returned 4 [0072.516] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.516] lstrlenW (lpString=".xls") returned 4 [0072.516] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.516] lstrlenW (lpString=".xlsx") returned 5 [0072.517] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1 [0072.517] lstrlenW (lpString=".ppt") returned 4 [0072.517] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0072.517] lstrlenW (lpString=".zip") returned 4 [0072.517] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.517] lstrlenW (lpString=".rar") returned 4 [0072.517] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.517] lstrlenW (lpString=".bz2") returned 4 [0072.517] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.517] lstrlenW (lpString=".7z") returned 3 [0072.517] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0072.517] lstrlenW (lpString=".dbf") returned 4 [0072.517] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.527] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.527] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.231] GetLastError () returned 0x0 [0073.231] ReadFile (in: hFile=0x184, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x621, lpOverlapped=0x0) returned 1 [0073.553] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0x630, lpOverlapped=0x0) returned 1 [0073.554] ReadFile (in: hFile=0x184, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.554] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x223fc9c*=0xea, lpOverlapped=0x0) returned 1 [0073.554] SetEndOfFile (hFile=0x210) returned 1 [0073.555] CloseHandle (hObject=0x210) returned 1 [0073.555] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.555] SetEndOfFile (hFile=0x184) returned 1 [0073.561] CloseHandle (hObject=0x184) returned 1 [0073.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0073.561] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0073.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.562] lstrlenW (lpString=".doc") returned 4 [0073.562] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.562] lstrlenW (lpString=".docx") returned 5 [0073.562] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0073.562] lstrlenW (lpString=".pdf") returned 4 [0073.562] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.562] lstrlenW (lpString=".xls") returned 4 [0073.562] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.562] lstrlenW (lpString=".xlsx") returned 5 [0073.562] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0073.562] lstrlenW (lpString=".ppt") returned 4 [0073.562] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.562] lstrlenW (lpString=".zip") returned 4 [0073.562] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.562] lstrlenW (lpString=".rar") returned 4 [0073.562] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.562] lstrlenW (lpString=".bz2") returned 4 [0073.562] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.562] lstrlenW (lpString=".7z") returned 3 [0073.562] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.562] lstrlenW (lpString=".dbf") returned 4 [0073.562] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.562] lstrlenW (lpString=".1cd") returned 4 [0073.562] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.562] lstrlenW (lpString=".jpg") returned 4 [0073.562] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.563] lstrlenW (lpString=".doc") returned 4 [0073.563] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.563] lstrlenW (lpString=".docx") returned 5 [0073.563] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0073.563] lstrlenW (lpString=".pdf") returned 4 [0073.563] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.563] lstrlenW (lpString=".xls") returned 4 [0073.563] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.563] lstrlenW (lpString=".xlsx") returned 5 [0073.563] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0073.563] lstrlenW (lpString=".ppt") returned 4 [0073.563] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.563] lstrlenW (lpString=".zip") returned 4 [0073.563] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.563] lstrlenW (lpString=".rar") returned 4 [0073.563] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.563] lstrlenW (lpString=".bz2") returned 4 [0073.563] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.563] lstrlenW (lpString=".7z") returned 3 [0073.563] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.563] lstrlenW (lpString=".dbf") returned 4 [0073.563] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.563] lstrlenW (lpString=".1cd") returned 4 [0073.563] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0073.563] lstrlenW (lpString=".jpg") returned 4 [0073.563] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.563] lstrcmpiW (lpString1=".GIF", lpString2=".beets") returned 1 [0073.564] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0073.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.826] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x223ff1c | out: lpFileSize=0x223ff1c*=2181) returned 1 [0073.826] CloseHandle (hObject=0x210) returned 1 [0073.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0073.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.827] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.827] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x223fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0073.827] GetLastError () returned 0x0 [0073.827] ReadFile (in: hFile=0x210, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x223fed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x223fed4*=0x885, lpOverlapped=0x0) returned 1 [0074.123] WriteFile (hFile=0x184, lpBuffer=0x3540020, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x223fc9c, lpOverlapped=0x0) Thread: id = 11 os_tid = 0xa60 [0051.597] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x680648 [0051.598] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x690650 [0051.598] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630270 [0051.598] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x61a368 [0051.598] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630288 [0051.598] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3650020 [0051.599] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630330 [0051.599] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630330, Size=0x20) returned 0x65fe78 [0051.599] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630330 [0051.599] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630330, Size=0x20) returned 0x65fec8 [0051.599] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0051.599] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0051.599] Wow64DisableWow64FsRedirection (in: OldValue=0x2b3ff58 | out: OldValue=0x2b3ff58*=0x0) returned 1 [0051.599] lstrlenW (lpString="kernel32.dll") returned 12 [0051.599] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fe78 | out: hHeap=0x5e0000) returned 1 [0051.599] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0051.599] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fec8 | out: hHeap=0x5e0000) returned 1 [0051.599] Sleep (dwMilliseconds=0x64) [0051.753] lstrlenW (lpString="BCD") returned 3 [0051.753] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.753] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.753] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.753] lstrlenW (lpString=".doc") returned 4 [0051.753] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0051.753] lstrlenW (lpString=".docx") returned 5 [0051.753] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0051.753] lstrlenW (lpString=".pdf") returned 4 [0051.753] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0051.753] lstrlenW (lpString=".xls") returned 4 [0051.753] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0051.753] lstrlenW (lpString=".xlsx") returned 5 [0051.753] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0051.753] lstrlenW (lpString=".ppt") returned 4 [0051.753] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0051.753] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.753] lstrlenW (lpString=".zip") returned 4 [0051.753] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0051.753] lstrlenW (lpString=".rar") returned 4 [0051.753] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString=".bz2") returned 4 [0051.754] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString=".7z") returned 3 [0051.754] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0051.754] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.754] lstrlenW (lpString=".dbf") returned 4 [0051.754] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.754] lstrlenW (lpString=".1cd") returned 4 [0051.754] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.754] lstrlenW (lpString=".jpg") returned 4 [0051.754] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.754] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.754] lstrlenW (lpString=".doc") returned 4 [0051.754] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString=".docx") returned 5 [0051.754] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0051.754] lstrlenW (lpString=".pdf") returned 4 [0051.754] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString=".xls") returned 4 [0051.754] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString=".xlsx") returned 5 [0051.754] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0051.754] lstrlenW (lpString=".ppt") returned 4 [0051.754] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0051.754] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.754] lstrlenW (lpString=".zip") returned 4 [0051.755] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0051.755] lstrlenW (lpString=".rar") returned 4 [0051.755] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0051.755] lstrlenW (lpString=".bz2") returned 4 [0051.755] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0051.755] lstrlenW (lpString=".7z") returned 3 [0051.755] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0051.755] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.755] lstrlenW (lpString=".dbf") returned 4 [0051.755] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0051.755] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.755] lstrlenW (lpString=".1cd") returned 4 [0051.755] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0051.755] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0051.755] lstrlenW (lpString=".jpg") returned 4 [0051.755] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0051.755] lstrcmpiW (lpString1=".LOG1", lpString2=".beets") returned 1 [0051.755] lstrlenW (lpString="BCD.LOG1") returned 8 [0051.755] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.037] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=0) returned 1 [0052.037] CloseHandle (hObject=0x168) returned 1 [0052.037] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.037] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.037] lstrlenW (lpString=".doc") returned 4 [0052.037] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0052.037] lstrlenW (lpString=".docx") returned 5 [0052.037] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0052.038] lstrlenW (lpString=".pdf") returned 4 [0052.038] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0052.038] lstrlenW (lpString=".xls") returned 4 [0052.038] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0052.038] lstrlenW (lpString=".xlsx") returned 5 [0052.038] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0052.038] lstrlenW (lpString=".ppt") returned 4 [0052.038] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0052.038] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.038] lstrlenW (lpString=".zip") returned 4 [0052.038] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0052.038] lstrlenW (lpString=".rar") returned 4 [0052.038] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0052.038] lstrlenW (lpString=".bz2") returned 4 [0052.038] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0052.038] lstrlenW (lpString=".7z") returned 3 [0052.038] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0052.038] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.038] lstrlenW (lpString=".dbf") returned 4 [0052.038] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0052.038] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.038] lstrlenW (lpString=".1cd") returned 4 [0052.038] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0052.038] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.039] lstrlenW (lpString=".jpg") returned 4 [0052.039] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0052.039] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.039] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.039] lstrlenW (lpString=".doc") returned 4 [0052.039] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0052.039] lstrlenW (lpString=".docx") returned 5 [0052.039] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0052.039] lstrlenW (lpString=".pdf") returned 4 [0052.039] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0052.039] lstrlenW (lpString=".xls") returned 4 [0052.039] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0052.039] lstrlenW (lpString=".xlsx") returned 5 [0052.040] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0052.040] lstrlenW (lpString=".ppt") returned 4 [0052.040] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0052.040] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.040] lstrlenW (lpString=".zip") returned 4 [0052.040] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0052.040] lstrlenW (lpString=".rar") returned 4 [0052.040] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0052.040] lstrlenW (lpString=".bz2") returned 4 [0052.040] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0052.040] lstrlenW (lpString=".7z") returned 3 [0052.040] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0052.040] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.040] lstrlenW (lpString=".dbf") returned 4 [0052.040] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0052.040] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.040] lstrlenW (lpString=".1cd") returned 4 [0052.040] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0052.040] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.040] lstrlenW (lpString=".jpg") returned 4 [0052.040] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0052.040] Sleep (dwMilliseconds=0x64) [0052.298] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0052.299] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0052.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.299] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2506240) returned 1 [0052.299] CloseHandle (hObject=0x188) returned 1 [0052.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0052.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.299] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0052.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.300] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.300] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.300] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.346] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.346] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.402] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.402] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.402] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.672] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.672] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.819] SetEndOfFile (hFile=0x188) returned 1 [0052.827] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f34080 [0052.900] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.900] WriteFile (in: hFile=0x188, lpBuffer=0x3f34080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34080*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.902] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.902] WriteFile (in: hFile=0x188, lpBuffer=0x3f34080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34080*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.910] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.910] WriteFile (in: hFile=0x188, lpBuffer=0x3f34080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34080*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.913] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f34080 | out: hHeap=0x5e0000) returned 1 [0052.913] CloseHandle (hObject=0x188) returned 1 [0053.086] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0053.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.087] lstrlenW (lpString=".doc") returned 4 [0053.087] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.087] lstrlenW (lpString=".docx") returned 5 [0053.087] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.087] lstrlenW (lpString=".pdf") returned 4 [0053.087] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.087] lstrlenW (lpString=".xls") returned 4 [0053.087] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.087] lstrlenW (lpString=".xlsx") returned 5 [0053.087] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.087] lstrlenW (lpString=".ppt") returned 4 [0053.087] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.087] lstrlenW (lpString=".zip") returned 4 [0053.087] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.087] lstrlenW (lpString=".rar") returned 4 [0053.087] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.087] lstrlenW (lpString=".bz2") returned 4 [0053.087] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.088] lstrlenW (lpString=".7z") returned 3 [0053.088] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.088] lstrlenW (lpString=".dbf") returned 4 [0053.088] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.088] lstrlenW (lpString=".1cd") returned 4 [0053.088] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.088] lstrlenW (lpString=".jpg") returned 4 [0053.088] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.088] lstrlenW (lpString=".doc") returned 4 [0053.088] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.088] lstrlenW (lpString=".docx") returned 5 [0053.088] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.088] lstrlenW (lpString=".pdf") returned 4 [0053.088] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.088] lstrlenW (lpString=".xls") returned 4 [0053.088] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.088] lstrlenW (lpString=".xlsx") returned 5 [0053.088] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.088] lstrlenW (lpString=".ppt") returned 4 [0053.088] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.088] lstrlenW (lpString=".zip") returned 4 [0053.089] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.089] lstrlenW (lpString=".rar") returned 4 [0053.089] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.089] lstrlenW (lpString=".bz2") returned 4 [0053.089] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.089] lstrlenW (lpString=".7z") returned 3 [0053.089] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.089] lstrlenW (lpString=".dbf") returned 4 [0053.089] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.089] lstrlenW (lpString=".1cd") returned 4 [0053.089] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0053.089] lstrlenW (lpString=".jpg") returned 4 [0053.089] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.089] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0053.089] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0053.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0053.090] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2513920) returned 1 [0053.090] CloseHandle (hObject=0x188) returned 1 [0053.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0053.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.090] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0053.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0053.091] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0053.091] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.091] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.542] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.543] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.724] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.725] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.725] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.810] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0053.989] SetEndOfFile (hFile=0x188) returned 1 [0053.989] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3ed1058 [0054.017] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.017] WriteFile (in: hFile=0x188, lpBuffer=0x3ed1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1058*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.019] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.019] WriteFile (in: hFile=0x188, lpBuffer=0x3ed1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1058*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.025] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.025] WriteFile (in: hFile=0x188, lpBuffer=0x3ed1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1058*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.029] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ed1058 | out: hHeap=0x5e0000) returned 1 [0054.029] CloseHandle (hObject=0x188) returned 1 [0055.943] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.943] lstrlenW (lpString=".doc") returned 4 [0055.943] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.943] lstrlenW (lpString=".docx") returned 5 [0055.943] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.943] lstrlenW (lpString=".pdf") returned 4 [0055.943] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.943] lstrlenW (lpString=".xls") returned 4 [0055.943] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.943] lstrlenW (lpString=".xlsx") returned 5 [0055.943] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.943] lstrlenW (lpString=".ppt") returned 4 [0055.943] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.943] lstrlenW (lpString=".zip") returned 4 [0055.943] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.943] lstrlenW (lpString=".rar") returned 4 [0055.944] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.944] lstrlenW (lpString=".bz2") returned 4 [0055.944] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.944] lstrlenW (lpString=".7z") returned 3 [0055.944] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.944] lstrlenW (lpString=".dbf") returned 4 [0055.944] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.944] lstrlenW (lpString=".1cd") returned 4 [0055.944] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.944] lstrlenW (lpString=".jpg") returned 4 [0055.944] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.944] lstrlenW (lpString=".doc") returned 4 [0055.944] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.944] lstrlenW (lpString=".docx") returned 5 [0055.944] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.944] lstrlenW (lpString=".pdf") returned 4 [0055.944] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.944] lstrlenW (lpString=".xls") returned 4 [0055.944] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.944] lstrlenW (lpString=".xlsx") returned 5 [0055.944] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.944] lstrlenW (lpString=".ppt") returned 4 [0055.944] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.945] lstrlenW (lpString=".zip") returned 4 [0055.945] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.945] lstrlenW (lpString=".rar") returned 4 [0055.945] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.945] lstrlenW (lpString=".bz2") returned 4 [0055.945] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.945] lstrlenW (lpString=".7z") returned 3 [0055.945] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.945] lstrlenW (lpString=".dbf") returned 4 [0055.945] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.945] lstrlenW (lpString=".1cd") returned 4 [0055.945] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0055.945] lstrlenW (lpString=".jpg") returned 4 [0055.945] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.945] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0055.945] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0055.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.946] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2865664) returned 1 [0055.946] CloseHandle (hObject=0x188) returned 1 [0055.946] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0055.946] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.946] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0055.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.947] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.947] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.947] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.055] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.055] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.242] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.242] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.242] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.059] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.059] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0058.222] SetEndOfFile (hFile=0x188) returned 1 [0058.222] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f44088 [0058.226] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.226] WriteFile (in: hFile=0x188, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.228] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.228] WriteFile (in: hFile=0x188, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.234] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.234] WriteFile (in: hFile=0x188, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.237] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f44088 | out: hHeap=0x5e0000) returned 1 [0058.239] CloseHandle (hObject=0x188) returned 1 [0058.561] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0058.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.562] lstrlenW (lpString=".doc") returned 4 [0058.562] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.562] lstrlenW (lpString=".docx") returned 5 [0058.562] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0058.562] lstrlenW (lpString=".pdf") returned 4 [0058.562] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.562] lstrlenW (lpString=".xls") returned 4 [0058.562] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.562] lstrlenW (lpString=".xlsx") returned 5 [0058.562] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0058.562] lstrlenW (lpString=".ppt") returned 4 [0058.562] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.563] lstrlenW (lpString=".zip") returned 4 [0058.563] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.563] lstrlenW (lpString=".rar") returned 4 [0058.563] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.563] lstrlenW (lpString=".bz2") returned 4 [0058.563] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.563] lstrlenW (lpString=".7z") returned 3 [0058.563] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.563] lstrlenW (lpString=".dbf") returned 4 [0058.563] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.563] lstrlenW (lpString=".1cd") returned 4 [0058.563] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.563] lstrlenW (lpString=".jpg") returned 4 [0058.563] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.563] lstrlenW (lpString=".doc") returned 4 [0058.563] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.563] lstrlenW (lpString=".docx") returned 5 [0058.563] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0058.563] lstrlenW (lpString=".pdf") returned 4 [0058.563] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.563] lstrlenW (lpString=".xls") returned 4 [0058.563] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.563] lstrlenW (lpString=".xlsx") returned 5 [0058.564] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0058.564] lstrlenW (lpString=".ppt") returned 4 [0058.564] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.564] lstrlenW (lpString=".zip") returned 4 [0058.564] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.564] lstrlenW (lpString=".rar") returned 4 [0058.564] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.564] lstrlenW (lpString=".bz2") returned 4 [0058.564] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.564] lstrlenW (lpString=".7z") returned 3 [0058.564] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.564] lstrlenW (lpString=".dbf") returned 4 [0058.564] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.564] lstrlenW (lpString=".1cd") returned 4 [0058.564] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0058.564] lstrlenW (lpString=".jpg") returned 4 [0058.564] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.564] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0058.564] lstrlenW (lpString="WordMUI.msi") returned 11 [0058.564] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.565] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2522624) returned 1 [0058.565] CloseHandle (hObject=0x188) returned 1 [0058.565] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0058.565] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0058.565] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0058.566] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.566] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.566] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.566] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.337] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.337] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.510] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.510] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.510] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.752] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.752] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0059.769] SetEndOfFile (hFile=0x188) returned 1 [0059.769] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f44088 [0059.773] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.773] WriteFile (in: hFile=0x188, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.775] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.775] WriteFile (in: hFile=0x188, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.996] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.996] WriteFile (in: hFile=0x188, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.999] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f44088 | out: hHeap=0x5e0000) returned 1 [0060.045] CloseHandle (hObject=0x188) returned 1 [0060.450] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0060.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.451] lstrlenW (lpString=".doc") returned 4 [0060.451] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.451] lstrlenW (lpString=".docx") returned 5 [0060.451] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0060.451] lstrlenW (lpString=".pdf") returned 4 [0060.451] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.451] lstrlenW (lpString=".xls") returned 4 [0060.451] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.451] lstrlenW (lpString=".xlsx") returned 5 [0060.451] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0060.451] lstrlenW (lpString=".ppt") returned 4 [0060.451] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.451] lstrlenW (lpString=".zip") returned 4 [0060.451] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.451] lstrlenW (lpString=".rar") returned 4 [0060.451] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.451] lstrlenW (lpString=".bz2") returned 4 [0060.451] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.451] lstrlenW (lpString=".7z") returned 3 [0060.452] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.452] lstrlenW (lpString=".dbf") returned 4 [0060.452] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.452] lstrlenW (lpString=".1cd") returned 4 [0060.452] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.452] lstrlenW (lpString=".jpg") returned 4 [0060.452] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.452] lstrlenW (lpString=".doc") returned 4 [0060.452] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.452] lstrlenW (lpString=".docx") returned 5 [0060.452] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0060.452] lstrlenW (lpString=".pdf") returned 4 [0060.452] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.452] lstrlenW (lpString=".xls") returned 4 [0060.452] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.452] lstrlenW (lpString=".xlsx") returned 5 [0060.452] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0060.452] lstrlenW (lpString=".ppt") returned 4 [0060.452] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.452] lstrlenW (lpString=".zip") returned 4 [0060.452] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.453] lstrlenW (lpString=".rar") returned 4 [0060.453] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.453] lstrlenW (lpString=".bz2") returned 4 [0060.453] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.453] lstrlenW (lpString=".7z") returned 3 [0060.453] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.453] lstrlenW (lpString=".dbf") returned 4 [0060.453] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.453] lstrlenW (lpString=".1cd") returned 4 [0060.453] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0060.453] lstrlenW (lpString=".jpg") returned 4 [0060.453] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.453] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0060.453] lstrlenW (lpString="Proof.cab") returned 9 [0060.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0060.454] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=21064532) returned 1 [0060.454] CloseHandle (hObject=0x188) returned 1 [0060.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0060.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.454] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0060.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0060.521] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.521] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.521] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.120] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.121] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.371] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.371] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.371] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.498] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.499] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0061.516] SetEndOfFile (hFile=0x188) returned 1 [0061.516] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f64088 [0061.521] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.521] WriteFile (in: hFile=0x188, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.522] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.522] WriteFile (in: hFile=0x188, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.523] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.523] WriteFile (in: hFile=0x188, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.865] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f64088 | out: hHeap=0x5e0000) returned 1 [0061.868] CloseHandle (hObject=0x188) returned 1 [0068.894] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0068.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.894] lstrlenW (lpString=".doc") returned 4 [0068.894] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0068.894] lstrlenW (lpString=".docx") returned 5 [0068.894] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0068.894] lstrlenW (lpString=".pdf") returned 4 [0068.895] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0068.895] lstrlenW (lpString=".xls") returned 4 [0068.895] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0068.895] lstrlenW (lpString=".xlsx") returned 5 [0068.895] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0068.895] lstrlenW (lpString=".ppt") returned 4 [0068.895] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0068.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.895] lstrlenW (lpString=".zip") returned 4 [0068.895] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0068.895] lstrlenW (lpString=".rar") returned 4 [0068.895] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0068.895] lstrlenW (lpString=".bz2") returned 4 [0068.895] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0068.895] lstrlenW (lpString=".7z") returned 3 [0068.895] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0068.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.895] lstrlenW (lpString=".dbf") returned 4 [0068.895] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0068.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.895] lstrlenW (lpString=".1cd") returned 4 [0068.895] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0068.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.895] lstrlenW (lpString=".jpg") returned 4 [0068.895] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0068.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.896] lstrlenW (lpString=".doc") returned 4 [0068.896] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0068.896] lstrlenW (lpString=".docx") returned 5 [0068.896] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0068.896] lstrlenW (lpString=".pdf") returned 4 [0068.896] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0068.896] lstrlenW (lpString=".xls") returned 4 [0068.896] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0068.896] lstrlenW (lpString=".xlsx") returned 5 [0068.896] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0068.896] lstrlenW (lpString=".ppt") returned 4 [0068.896] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0068.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.896] lstrlenW (lpString=".zip") returned 4 [0068.896] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0068.896] lstrlenW (lpString=".rar") returned 4 [0068.896] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0068.896] lstrlenW (lpString=".bz2") returned 4 [0068.897] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0068.897] lstrlenW (lpString=".7z") returned 3 [0068.897] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0068.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.897] lstrlenW (lpString=".dbf") returned 4 [0068.897] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0068.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.897] lstrlenW (lpString=".1cd") returned 4 [0068.897] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0068.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0068.897] lstrlenW (lpString=".jpg") returned 4 [0068.897] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0068.897] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0068.897] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0068.897] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0068.897] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3124224) returned 1 [0068.898] CloseHandle (hObject=0x188) returned 1 [0068.898] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0068.898] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0068.898] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0068.925] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0068.926] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0068.926] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.926] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.598] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.598] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.893] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0069.893] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.893] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.937] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.937] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0069.955] SetEndOfFile (hFile=0x188) returned 1 [0069.956] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f64088 [0069.960] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.960] WriteFile (in: hFile=0x188, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.961] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.961] WriteFile (in: hFile=0x188, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.964] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.964] WriteFile (in: hFile=0x188, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.966] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f64088 | out: hHeap=0x5e0000) returned 1 [0069.966] CloseHandle (hObject=0x188) returned 1 [0069.967] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0069.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.967] lstrlenW (lpString=".doc") returned 4 [0069.967] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.967] lstrlenW (lpString=".docx") returned 5 [0069.967] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0069.967] lstrlenW (lpString=".pdf") returned 4 [0069.967] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.967] lstrlenW (lpString=".xls") returned 4 [0069.967] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.967] lstrlenW (lpString=".xlsx") returned 5 [0069.967] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0069.967] lstrlenW (lpString=".ppt") returned 4 [0069.967] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.967] lstrlenW (lpString=".zip") returned 4 [0069.967] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.967] lstrlenW (lpString=".rar") returned 4 [0069.967] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.967] lstrlenW (lpString=".bz2") returned 4 [0069.967] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.967] lstrlenW (lpString=".7z") returned 3 [0069.967] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.967] lstrlenW (lpString=".dbf") returned 4 [0069.967] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.967] lstrlenW (lpString=".1cd") returned 4 [0069.967] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.968] lstrlenW (lpString=".jpg") returned 4 [0069.968] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.968] lstrlenW (lpString=".doc") returned 4 [0069.968] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.968] lstrlenW (lpString=".docx") returned 5 [0069.968] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0069.968] lstrlenW (lpString=".pdf") returned 4 [0069.968] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.968] lstrlenW (lpString=".xls") returned 4 [0069.968] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.968] lstrlenW (lpString=".xlsx") returned 5 [0069.968] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0069.968] lstrlenW (lpString=".ppt") returned 4 [0069.968] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.968] lstrlenW (lpString=".zip") returned 4 [0069.968] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.968] lstrlenW (lpString=".rar") returned 4 [0069.968] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.968] lstrlenW (lpString=".bz2") returned 4 [0069.968] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.968] lstrlenW (lpString=".7z") returned 3 [0069.968] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.968] lstrlenW (lpString=".dbf") returned 4 [0069.968] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.968] lstrlenW (lpString=".1cd") returned 4 [0069.968] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0069.968] lstrlenW (lpString=".jpg") returned 4 [0069.968] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.969] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0069.969] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0069.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0069.969] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2503680) returned 1 [0069.969] CloseHandle (hObject=0x188) returned 1 [0069.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0069.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.969] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0069.970] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0069.970] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0069.970] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.970] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.180] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.180] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.380] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.380] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.380] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.416] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.416] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0070.428] SetEndOfFile (hFile=0x188) returned 1 [0070.428] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0070.444] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.444] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.444] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.444] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.445] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.445] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.447] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0070.447] CloseHandle (hObject=0x188) returned 1 [0070.448] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.448] lstrlenW (lpString=".doc") returned 4 [0070.448] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.448] lstrlenW (lpString=".docx") returned 5 [0070.448] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.448] lstrlenW (lpString=".pdf") returned 4 [0070.448] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.448] lstrlenW (lpString=".xls") returned 4 [0070.448] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.448] lstrlenW (lpString=".xlsx") returned 5 [0070.448] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.448] lstrlenW (lpString=".ppt") returned 4 [0070.448] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.448] lstrlenW (lpString=".zip") returned 4 [0070.448] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.448] lstrlenW (lpString=".rar") returned 4 [0070.449] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.449] lstrlenW (lpString=".bz2") returned 4 [0070.449] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.449] lstrlenW (lpString=".7z") returned 3 [0070.449] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.449] lstrlenW (lpString=".dbf") returned 4 [0070.449] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.449] lstrlenW (lpString=".1cd") returned 4 [0070.449] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.449] lstrlenW (lpString=".jpg") returned 4 [0070.449] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.449] lstrlenW (lpString=".doc") returned 4 [0070.449] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.449] lstrlenW (lpString=".docx") returned 5 [0070.449] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.449] lstrlenW (lpString=".pdf") returned 4 [0070.449] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.449] lstrlenW (lpString=".xls") returned 4 [0070.449] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.449] lstrlenW (lpString=".xlsx") returned 5 [0070.449] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.449] lstrlenW (lpString=".ppt") returned 4 [0070.449] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.450] lstrlenW (lpString=".zip") returned 4 [0070.450] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.450] lstrlenW (lpString=".rar") returned 4 [0070.450] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.450] lstrlenW (lpString=".bz2") returned 4 [0070.450] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.450] lstrlenW (lpString=".7z") returned 3 [0070.450] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.450] lstrlenW (lpString=".dbf") returned 4 [0070.450] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.450] lstrlenW (lpString=".1cd") returned 4 [0070.450] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0070.450] lstrlenW (lpString=".jpg") returned 4 [0070.450] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.450] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0070.450] lstrlenW (lpString="ProjLR.cab") returned 10 [0070.450] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0070.462] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=8265165) returned 1 [0070.464] CloseHandle (hObject=0x188) returned 1 [0070.464] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0070.465] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.465] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0070.465] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0070.465] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0070.465] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.466] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.477] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.477] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.577] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.610] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.610] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0070.755] SetEndOfFile (hFile=0x188) returned 1 [0070.755] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0070.755] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.755] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.757] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.757] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.759] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.759] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.761] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0070.761] CloseHandle (hObject=0x188) returned 1 [0070.761] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.761] lstrlenW (lpString=".doc") returned 4 [0070.761] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.761] lstrlenW (lpString=".docx") returned 5 [0070.761] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0070.761] lstrlenW (lpString=".pdf") returned 4 [0070.761] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.761] lstrlenW (lpString=".xls") returned 4 [0070.761] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.761] lstrlenW (lpString=".xlsx") returned 5 [0070.761] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0070.761] lstrlenW (lpString=".ppt") returned 4 [0070.761] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.761] lstrlenW (lpString=".zip") returned 4 [0070.761] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.761] lstrlenW (lpString=".rar") returned 4 [0070.761] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.761] lstrlenW (lpString=".bz2") returned 4 [0070.761] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.761] lstrlenW (lpString=".7z") returned 3 [0070.762] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.762] lstrlenW (lpString=".dbf") returned 4 [0070.762] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.762] lstrlenW (lpString=".1cd") returned 4 [0070.762] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.762] lstrlenW (lpString=".jpg") returned 4 [0070.762] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.762] lstrlenW (lpString=".doc") returned 4 [0070.762] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString=".docx") returned 5 [0070.762] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0070.762] lstrlenW (lpString=".pdf") returned 4 [0070.762] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString=".xls") returned 4 [0070.762] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString=".xlsx") returned 5 [0070.762] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0070.762] lstrlenW (lpString=".ppt") returned 4 [0070.762] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.762] lstrlenW (lpString=".zip") returned 4 [0070.762] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString=".rar") returned 4 [0070.762] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString=".bz2") returned 4 [0070.762] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.762] lstrlenW (lpString=".7z") returned 3 [0070.762] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.762] lstrlenW (lpString=".dbf") returned 4 [0070.762] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.763] lstrlenW (lpString=".1cd") returned 4 [0070.763] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0070.763] lstrlenW (lpString=".jpg") returned 4 [0070.763] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.763] lstrcmpiW (lpString1=".dll", lpString2=".beets") returned 1 [0070.763] lstrlenW (lpString="dwintl20.dll") returned 12 [0070.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0070.763] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=107912) returned 1 [0070.763] CloseHandle (hObject=0x188) returned 1 [0070.763] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0070.763] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0070.763] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.764] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.764] GetLastError () returned 0x0 [0070.764] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0070.905] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0070.907] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.907] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.907] SetEndOfFile (hFile=0x1a4) returned 1 [0070.907] CloseHandle (hObject=0x1a4) returned 1 [0070.908] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.908] SetEndOfFile (hFile=0x188) returned 1 [0070.908] CloseHandle (hObject=0x188) returned 1 [0070.908] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.909] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0070.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.909] lstrlenW (lpString=".doc") returned 4 [0070.909] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.909] lstrlenW (lpString=".docx") returned 5 [0070.909] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0070.909] lstrlenW (lpString=".pdf") returned 4 [0070.909] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.909] lstrlenW (lpString=".xls") returned 4 [0070.909] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.909] lstrlenW (lpString=".xlsx") returned 5 [0070.909] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0070.909] lstrlenW (lpString=".ppt") returned 4 [0070.909] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.909] lstrlenW (lpString=".zip") returned 4 [0070.909] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.909] lstrlenW (lpString=".rar") returned 4 [0070.909] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.909] lstrlenW (lpString=".bz2") returned 4 [0070.909] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.909] lstrlenW (lpString=".7z") returned 3 [0070.909] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.909] lstrlenW (lpString=".dbf") returned 4 [0070.910] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.910] lstrlenW (lpString=".1cd") returned 4 [0070.910] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.910] lstrlenW (lpString=".jpg") returned 4 [0070.910] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.910] lstrlenW (lpString=".doc") returned 4 [0070.910] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.910] lstrlenW (lpString=".docx") returned 5 [0070.910] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0070.910] lstrlenW (lpString=".pdf") returned 4 [0070.910] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.910] lstrlenW (lpString=".xls") returned 4 [0070.910] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.910] lstrlenW (lpString=".xlsx") returned 5 [0070.910] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0070.910] lstrlenW (lpString=".ppt") returned 4 [0070.910] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.910] lstrlenW (lpString=".zip") returned 4 [0070.910] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.910] lstrlenW (lpString=".rar") returned 4 [0070.910] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.910] lstrlenW (lpString=".bz2") returned 4 [0070.911] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.911] lstrlenW (lpString=".7z") returned 3 [0070.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.911] lstrlenW (lpString=".dbf") returned 4 [0070.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.911] lstrlenW (lpString=".1cd") returned 4 [0070.911] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0070.911] lstrlenW (lpString=".jpg") returned 4 [0070.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.911] lstrcmpiW (lpString1=".dll", lpString2=".beets") returned 1 [0070.911] lstrlenW (lpString="dwdcw20.dll") returned 11 [0070.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0070.911] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=526176) returned 1 [0070.911] CloseHandle (hObject=0x188) returned 1 [0070.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0070.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0070.912] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.912] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0070.912] GetLastError () returned 0x0 [0070.912] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x80760, lpOverlapped=0x0) returned 1 [0070.938] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0070.951] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.951] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.952] SetEndOfFile (hFile=0x1a4) returned 1 [0070.952] CloseHandle (hObject=0x1a4) returned 1 [0070.952] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.952] SetEndOfFile (hFile=0x188) returned 1 [0070.954] CloseHandle (hObject=0x188) returned 1 [0070.954] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.954] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0070.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.954] lstrlenW (lpString=".doc") returned 4 [0070.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.955] lstrlenW (lpString=".docx") returned 5 [0070.955] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0070.955] lstrlenW (lpString=".pdf") returned 4 [0070.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.955] lstrlenW (lpString=".xls") returned 4 [0070.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.955] lstrlenW (lpString=".xlsx") returned 5 [0070.955] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0070.955] lstrlenW (lpString=".ppt") returned 4 [0070.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.955] lstrlenW (lpString=".zip") returned 4 [0070.955] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.955] lstrlenW (lpString=".rar") returned 4 [0070.955] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.955] lstrlenW (lpString=".bz2") returned 4 [0070.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.955] lstrlenW (lpString=".7z") returned 3 [0070.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.955] lstrlenW (lpString=".dbf") returned 4 [0070.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.955] lstrlenW (lpString=".1cd") returned 4 [0070.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.955] lstrlenW (lpString=".jpg") returned 4 [0070.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.956] lstrlenW (lpString=".doc") returned 4 [0070.956] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.956] lstrlenW (lpString=".docx") returned 5 [0070.956] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0070.956] lstrlenW (lpString=".pdf") returned 4 [0070.956] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.956] lstrlenW (lpString=".xls") returned 4 [0070.956] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.956] lstrlenW (lpString=".xlsx") returned 5 [0070.956] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0070.956] lstrlenW (lpString=".ppt") returned 4 [0070.956] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.956] lstrlenW (lpString=".zip") returned 4 [0070.956] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.956] lstrlenW (lpString=".rar") returned 4 [0070.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.956] lstrlenW (lpString=".bz2") returned 4 [0070.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.956] lstrlenW (lpString=".7z") returned 3 [0070.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.956] lstrlenW (lpString=".dbf") returned 4 [0070.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.956] lstrlenW (lpString=".1cd") returned 4 [0070.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0070.956] lstrlenW (lpString=".jpg") returned 4 [0070.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.957] lstrcmpiW (lpString1=".exe", lpString2=".beets") returned 1 [0070.957] lstrlenW (lpString="dwtrig20.exe") returned 12 [0070.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0070.957] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=519584) returned 1 [0070.957] CloseHandle (hObject=0x188) returned 1 [0070.957] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0070.957] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0070.957] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.957] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0071.193] GetLastError () returned 0x0 [0071.193] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0071.320] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0071.328] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.328] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.328] SetEndOfFile (hFile=0x20c) returned 1 [0071.328] CloseHandle (hObject=0x20c) returned 1 [0071.329] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.329] SetEndOfFile (hFile=0x188) returned 1 [0071.330] CloseHandle (hObject=0x188) returned 1 [0071.331] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.331] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0071.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.331] lstrlenW (lpString=".doc") returned 4 [0071.331] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0071.331] lstrlenW (lpString=".docx") returned 5 [0071.331] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0071.331] lstrlenW (lpString=".pdf") returned 4 [0071.331] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0071.331] lstrlenW (lpString=".xls") returned 4 [0071.331] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0071.331] lstrlenW (lpString=".xlsx") returned 5 [0071.331] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0071.331] lstrlenW (lpString=".ppt") returned 4 [0071.332] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.332] lstrlenW (lpString=".zip") returned 4 [0071.332] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0071.332] lstrlenW (lpString=".rar") returned 4 [0071.332] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0071.332] lstrlenW (lpString=".bz2") returned 4 [0071.332] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0071.332] lstrlenW (lpString=".7z") returned 3 [0071.332] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.332] lstrlenW (lpString=".dbf") returned 4 [0071.332] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.332] lstrlenW (lpString=".1cd") returned 4 [0071.332] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.332] lstrlenW (lpString=".jpg") returned 4 [0071.332] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.332] lstrlenW (lpString=".doc") returned 4 [0071.332] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0071.332] lstrlenW (lpString=".docx") returned 5 [0071.332] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0071.332] lstrlenW (lpString=".pdf") returned 4 [0071.332] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0071.332] lstrlenW (lpString=".xls") returned 4 [0071.332] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0071.332] lstrlenW (lpString=".xlsx") returned 5 [0071.333] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0071.333] lstrlenW (lpString=".ppt") returned 4 [0071.333] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0071.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.333] lstrlenW (lpString=".zip") returned 4 [0071.333] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0071.333] lstrlenW (lpString=".rar") returned 4 [0071.333] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0071.333] lstrlenW (lpString=".bz2") returned 4 [0071.333] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0071.333] lstrlenW (lpString=".7z") returned 3 [0071.333] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0071.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.333] lstrlenW (lpString=".dbf") returned 4 [0071.333] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0071.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.333] lstrlenW (lpString=".1cd") returned 4 [0071.333] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0071.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0071.333] lstrlenW (lpString=".jpg") returned 4 [0071.333] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0071.333] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0071.333] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0071.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0071.334] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3702272) returned 1 [0071.334] CloseHandle (hObject=0x188) returned 1 [0071.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0071.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.334] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0071.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0071.335] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0071.335] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.335] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.476] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.476] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.636] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.636] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.636] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.799] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.799] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0071.815] SetEndOfFile (hFile=0x188) returned 1 [0071.862] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0071.862] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.862] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.864] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.864] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.868] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.868] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.871] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0071.871] CloseHandle (hObject=0x188) returned 1 [0071.871] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.872] lstrlenW (lpString=".doc") returned 4 [0071.872] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.872] lstrlenW (lpString=".docx") returned 5 [0071.872] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0071.872] lstrlenW (lpString=".pdf") returned 4 [0071.872] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.872] lstrlenW (lpString=".xls") returned 4 [0071.872] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.872] lstrlenW (lpString=".xlsx") returned 5 [0071.872] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0071.872] lstrlenW (lpString=".ppt") returned 4 [0071.872] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.873] lstrlenW (lpString=".zip") returned 4 [0071.873] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.873] lstrlenW (lpString=".rar") returned 4 [0071.873] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.873] lstrlenW (lpString=".bz2") returned 4 [0071.873] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.873] lstrlenW (lpString=".7z") returned 3 [0071.873] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.873] lstrlenW (lpString=".dbf") returned 4 [0071.873] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.873] lstrlenW (lpString=".1cd") returned 4 [0071.873] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.873] lstrlenW (lpString=".jpg") returned 4 [0071.873] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.873] lstrlenW (lpString=".doc") returned 4 [0071.873] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.873] lstrlenW (lpString=".docx") returned 5 [0071.873] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0071.873] lstrlenW (lpString=".pdf") returned 4 [0071.873] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.873] lstrlenW (lpString=".xls") returned 4 [0071.873] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.874] lstrlenW (lpString=".xlsx") returned 5 [0071.874] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0071.874] lstrlenW (lpString=".ppt") returned 4 [0071.874] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.874] lstrlenW (lpString=".zip") returned 4 [0071.874] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.874] lstrlenW (lpString=".rar") returned 4 [0071.874] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.874] lstrlenW (lpString=".bz2") returned 4 [0071.874] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.874] lstrlenW (lpString=".7z") returned 3 [0071.874] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.874] lstrlenW (lpString=".dbf") returned 4 [0071.874] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.874] lstrlenW (lpString=".1cd") returned 4 [0071.874] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0071.874] lstrlenW (lpString=".jpg") returned 4 [0071.874] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.874] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0071.874] lstrlenW (lpString="Office32WW.msi") returned 14 [0071.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0071.875] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1992192) returned 1 [0071.875] CloseHandle (hObject=0x188) returned 1 [0071.875] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0071.875] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.875] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0071.878] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0071.879] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0071.879] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.879] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.928] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.928] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.994] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.292] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.292] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0072.306] SetEndOfFile (hFile=0x188) returned 1 [0072.306] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0072.306] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.306] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.308] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.308] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.313] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.313] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.316] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0072.316] CloseHandle (hObject=0x188) returned 1 [0072.316] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0072.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.316] lstrlenW (lpString=".doc") returned 4 [0072.316] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0072.316] lstrlenW (lpString=".docx") returned 5 [0072.316] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0072.316] lstrlenW (lpString=".pdf") returned 4 [0072.316] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0072.316] lstrlenW (lpString=".xls") returned 4 [0072.316] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0072.316] lstrlenW (lpString=".xlsx") returned 5 [0072.316] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0072.316] lstrlenW (lpString=".ppt") returned 4 [0072.317] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0072.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.317] lstrlenW (lpString=".zip") returned 4 [0072.317] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0072.317] lstrlenW (lpString=".rar") returned 4 [0072.317] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0072.317] lstrlenW (lpString=".bz2") returned 4 [0072.317] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0072.317] lstrlenW (lpString=".7z") returned 3 [0072.317] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0072.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.317] lstrlenW (lpString=".dbf") returned 4 [0072.317] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0072.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.317] lstrlenW (lpString=".1cd") returned 4 [0072.317] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0072.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.317] lstrlenW (lpString=".jpg") returned 4 [0072.317] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0072.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.317] lstrlenW (lpString=".doc") returned 4 [0072.317] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0072.317] lstrlenW (lpString=".docx") returned 5 [0072.317] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0072.317] lstrlenW (lpString=".pdf") returned 4 [0072.317] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0072.317] lstrlenW (lpString=".xls") returned 4 [0072.317] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0072.318] lstrlenW (lpString=".xlsx") returned 5 [0072.318] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0072.318] lstrlenW (lpString=".ppt") returned 4 [0072.318] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0072.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.318] lstrlenW (lpString=".zip") returned 4 [0072.318] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0072.318] lstrlenW (lpString=".rar") returned 4 [0072.318] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0072.318] lstrlenW (lpString=".bz2") returned 4 [0072.318] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0072.318] lstrlenW (lpString=".7z") returned 3 [0072.318] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0072.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.318] lstrlenW (lpString=".dbf") returned 4 [0072.318] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0072.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.318] lstrlenW (lpString=".1cd") returned 4 [0072.318] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0072.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.318] lstrlenW (lpString=".jpg") returned 4 [0072.318] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0072.318] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0072.318] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0072.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0072.319] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=36233052) returned 1 [0072.319] CloseHandle (hObject=0x188) returned 1 [0072.319] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0072.319] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.321] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0072.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0072.322] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0072.322] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.322] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.539] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.540] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.696] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0072.696] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.696] ReadFile (in: hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.172] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.172] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0073.184] SetEndOfFile (hFile=0x188) returned 1 [0073.184] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0073.189] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.189] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.189] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.189] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.190] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.190] WriteFile (in: hFile=0x188, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.223] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0073.223] CloseHandle (hObject=0x188) returned 1 [0073.223] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0073.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.223] lstrlenW (lpString=".doc") returned 4 [0073.223] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.224] lstrlenW (lpString=".docx") returned 5 [0073.224] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0073.224] lstrlenW (lpString=".pdf") returned 4 [0073.224] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.224] lstrlenW (lpString=".xls") returned 4 [0073.224] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.224] lstrlenW (lpString=".xlsx") returned 5 [0073.224] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0073.224] lstrlenW (lpString=".ppt") returned 4 [0073.224] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.224] lstrlenW (lpString=".zip") returned 4 [0073.224] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.224] lstrlenW (lpString=".rar") returned 4 [0073.224] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.224] lstrlenW (lpString=".bz2") returned 4 [0073.224] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.224] lstrlenW (lpString=".7z") returned 3 [0073.224] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.224] lstrlenW (lpString=".dbf") returned 4 [0073.224] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.224] lstrlenW (lpString=".1cd") returned 4 [0073.224] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.224] lstrlenW (lpString=".jpg") returned 4 [0073.224] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.225] lstrlenW (lpString=".doc") returned 4 [0073.225] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.225] lstrlenW (lpString=".docx") returned 5 [0073.225] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0073.225] lstrlenW (lpString=".pdf") returned 4 [0073.225] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.225] lstrlenW (lpString=".xls") returned 4 [0073.225] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.225] lstrlenW (lpString=".xlsx") returned 5 [0073.225] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0073.225] lstrlenW (lpString=".ppt") returned 4 [0073.225] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.225] lstrlenW (lpString=".zip") returned 4 [0073.225] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.225] lstrlenW (lpString=".rar") returned 4 [0073.225] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.225] lstrlenW (lpString=".bz2") returned 4 [0073.225] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.225] lstrlenW (lpString=".7z") returned 3 [0073.225] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.226] lstrlenW (lpString=".dbf") returned 4 [0073.226] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.226] lstrlenW (lpString=".1cd") returned 4 [0073.226] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0073.226] lstrlenW (lpString=".jpg") returned 4 [0073.226] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.226] lstrcmpiW (lpString1=".exe", lpString2=".beets") returned 1 [0073.226] lstrlenW (lpString="setup.exe") returned 9 [0073.226] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0073.226] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1377656) returned 1 [0073.226] CloseHandle (hObject=0x188) returned 1 [0073.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0073.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0073.227] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.227] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0073.227] GetLastError () returned 0x0 [0073.227] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0073.272] WriteFile (in: hFile=0x160, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0073.299] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x50588, lpOverlapped=0x0) returned 1 [0073.643] WriteFile (in: hFile=0x160, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0073.684] ReadFile (in: hFile=0x188, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.684] WriteFile (in: hFile=0x160, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.685] SetEndOfFile (hFile=0x160) returned 1 [0073.685] CloseHandle (hObject=0x160) returned 1 [0073.685] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.685] SetEndOfFile (hFile=0x188) returned 1 [0073.687] CloseHandle (hObject=0x188) returned 1 [0073.687] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0073.688] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0073.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.688] lstrlenW (lpString=".doc") returned 4 [0073.688] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.688] lstrlenW (lpString=".docx") returned 5 [0073.688] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0073.688] lstrlenW (lpString=".pdf") returned 4 [0073.688] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.688] lstrlenW (lpString=".xls") returned 4 [0073.688] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.688] lstrlenW (lpString=".xlsx") returned 5 [0073.688] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0073.688] lstrlenW (lpString=".ppt") returned 4 [0073.688] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.688] lstrlenW (lpString=".zip") returned 4 [0073.688] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.688] lstrlenW (lpString=".rar") returned 4 [0073.688] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.688] lstrlenW (lpString=".bz2") returned 4 [0073.688] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.688] lstrlenW (lpString=".7z") returned 3 [0073.688] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.688] lstrlenW (lpString=".dbf") returned 4 [0073.688] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.688] lstrlenW (lpString=".1cd") returned 4 [0073.688] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.688] lstrlenW (lpString=".jpg") returned 4 [0073.689] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.689] lstrlenW (lpString=".doc") returned 4 [0073.689] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.689] lstrlenW (lpString=".docx") returned 5 [0073.689] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0073.689] lstrlenW (lpString=".pdf") returned 4 [0073.689] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.689] lstrlenW (lpString=".xls") returned 4 [0073.689] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.689] lstrlenW (lpString=".xlsx") returned 5 [0073.689] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0073.689] lstrlenW (lpString=".ppt") returned 4 [0073.689] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.689] lstrlenW (lpString=".zip") returned 4 [0073.689] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.689] lstrlenW (lpString=".rar") returned 4 [0073.689] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.689] lstrlenW (lpString=".bz2") returned 4 [0073.689] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.689] lstrlenW (lpString=".7z") returned 3 [0073.689] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.689] lstrlenW (lpString=".dbf") returned 4 [0073.689] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.689] lstrlenW (lpString=".1cd") returned 4 [0073.689] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0073.689] lstrlenW (lpString=".jpg") returned 4 [0073.689] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.689] lstrcmpiW (lpString1=".dll", lpString2=".beets") returned 1 [0073.690] lstrlenW (lpString="osetup.dll") returned 10 [0073.690] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0073.690] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=7378792) returned 1 [0073.690] CloseHandle (hObject=0x188) returned 1 [0073.690] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0073.690] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.690] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0073.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0073.694] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0073.694] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.694] ReadFile (in: hFile=0x188, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.812] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.812] ReadFile (in: hFile=0x188, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.117] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.117] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.117] ReadFile (hFile=0x188, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0) Thread: id = 12 os_tid = 0xa64 [0051.600] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x6a0868 [0051.600] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x6b0870 [0051.600] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630330 [0051.601] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x633090 [0051.601] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630348 [0051.601] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3760020 [0051.601] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630360 [0051.601] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630360, Size=0x20) returned 0x65fec8 [0051.601] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630360 [0051.601] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630360, Size=0x20) returned 0x65fe78 [0051.601] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0051.601] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0051.601] Wow64DisableWow64FsRedirection (in: OldValue=0x2c7ff58 | out: OldValue=0x2c7ff58*=0x0) returned 1 [0051.602] lstrlenW (lpString="kernel32.dll") returned 12 [0051.602] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fec8 | out: hHeap=0x5e0000) returned 1 [0051.602] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0051.602] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fe78 | out: hHeap=0x5e0000) returned 1 [0051.602] Sleep (dwMilliseconds=0x64) [0051.728] lstrcmpiW (lpString1=".ini", lpString2=".beets") returned 1 [0051.728] lstrlenW (lpString="desktop.ini") returned 11 [0051.728] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0051.728] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=129) returned 1 [0051.728] CloseHandle (hObject=0x160) returned 1 [0051.728] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0051.728] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.728] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0051.728] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.728] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.728] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.729] GetLastError () returned 0x0 [0051.729] ReadFile (in: hFile=0x160, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x81, lpOverlapped=0x0) returned 1 [0051.740] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x90, lpOverlapped=0x0) returned 1 [0051.741] ReadFile (in: hFile=0x160, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.742] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.742] SetEndOfFile (hFile=0x168) returned 1 [0051.742] CloseHandle (hObject=0x168) returned 1 [0051.745] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.745] SetEndOfFile (hFile=0x160) returned 1 [0051.746] CloseHandle (hObject=0x160) returned 1 [0051.747] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x26) returned 1 [0051.747] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0051.747] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.747] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.747] lstrlenW (lpString=".doc") returned 4 [0051.747] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.747] lstrlenW (lpString=".docx") returned 5 [0051.747] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0051.747] lstrlenW (lpString=".pdf") returned 4 [0051.747] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0051.748] lstrlenW (lpString=".xls") returned 4 [0051.748] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0051.748] lstrlenW (lpString=".xlsx") returned 5 [0051.748] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0051.748] lstrlenW (lpString=".ppt") returned 4 [0051.748] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0051.748] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.748] lstrlenW (lpString=".zip") returned 4 [0051.748] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0051.748] lstrlenW (lpString=".rar") returned 4 [0051.748] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0051.748] lstrlenW (lpString=".bz2") returned 4 [0051.748] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.748] lstrlenW (lpString=".7z") returned 3 [0051.748] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.748] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.748] lstrlenW (lpString=".dbf") returned 4 [0051.748] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.748] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.748] lstrlenW (lpString=".1cd") returned 4 [0051.748] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.748] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.748] lstrlenW (lpString=".jpg") returned 4 [0051.748] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0051.748] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.748] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.749] lstrlenW (lpString=".doc") returned 4 [0051.749] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.749] lstrlenW (lpString=".docx") returned 5 [0051.749] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0051.749] lstrlenW (lpString=".pdf") returned 4 [0051.749] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0051.749] lstrlenW (lpString=".xls") returned 4 [0051.749] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0051.749] lstrlenW (lpString=".xlsx") returned 5 [0051.749] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0051.749] lstrlenW (lpString=".ppt") returned 4 [0051.749] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0051.749] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.749] lstrlenW (lpString=".zip") returned 4 [0051.749] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0051.749] lstrlenW (lpString=".rar") returned 4 [0051.749] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0051.749] lstrlenW (lpString=".bz2") returned 4 [0051.749] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.749] lstrlenW (lpString=".7z") returned 3 [0051.749] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.749] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.749] lstrlenW (lpString=".dbf") returned 4 [0051.749] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.749] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.749] lstrlenW (lpString=".1cd") returned 4 [0051.749] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.750] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.750] lstrlenW (lpString=".jpg") returned 4 [0051.750] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0051.750] lstrcmpiW (lpString1=".LOG", lpString2=".beets") returned 1 [0051.750] lstrlenW (lpString="BCD.LOG") returned 7 [0051.750] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.750] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.750] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.750] lstrlenW (lpString=".doc") returned 4 [0051.750] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0051.750] lstrlenW (lpString=".docx") returned 5 [0051.750] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0051.750] lstrlenW (lpString=".pdf") returned 4 [0051.750] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0051.750] lstrlenW (lpString=".xls") returned 4 [0051.750] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0051.750] lstrlenW (lpString=".xlsx") returned 5 [0051.750] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0051.751] lstrlenW (lpString=".ppt") returned 4 [0051.751] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0051.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.751] lstrlenW (lpString=".zip") returned 4 [0051.751] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0051.751] lstrlenW (lpString=".rar") returned 4 [0051.751] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0051.751] lstrlenW (lpString=".bz2") returned 4 [0051.751] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0051.751] lstrlenW (lpString=".7z") returned 3 [0051.751] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0051.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.751] lstrlenW (lpString=".dbf") returned 4 [0051.751] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0051.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.751] lstrlenW (lpString=".1cd") returned 4 [0051.751] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0051.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.751] lstrlenW (lpString=".jpg") returned 4 [0051.751] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0051.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.751] lstrlenW (lpString=".doc") returned 4 [0051.751] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0051.751] lstrlenW (lpString=".docx") returned 5 [0051.751] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0051.751] lstrlenW (lpString=".pdf") returned 4 [0051.751] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0051.751] lstrlenW (lpString=".xls") returned 4 [0051.751] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0051.751] lstrlenW (lpString=".xlsx") returned 5 [0051.751] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0051.752] lstrlenW (lpString=".ppt") returned 4 [0051.752] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0051.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.752] lstrlenW (lpString=".zip") returned 4 [0051.752] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0051.752] lstrlenW (lpString=".rar") returned 4 [0051.752] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0051.752] lstrlenW (lpString=".bz2") returned 4 [0051.752] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0051.752] lstrlenW (lpString=".7z") returned 3 [0051.752] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0051.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.752] lstrlenW (lpString=".dbf") returned 4 [0051.752] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0051.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.752] lstrlenW (lpString=".1cd") returned 4 [0051.752] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0051.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0051.752] lstrlenW (lpString=".jpg") returned 4 [0051.752] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0051.752] lstrcmpiW (lpString1=".DAT", lpString2=".beets") returned 1 [0051.752] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0051.752] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.211] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=65536) returned 1 [0052.211] CloseHandle (hObject=0x16c) returned 1 [0052.211] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0052.211] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.211] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.211] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.211] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.211] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.212] GetLastError () returned 0x0 [0052.212] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x10000, lpOverlapped=0x0) returned 1 [0052.216] WriteFile (in: hFile=0x170, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0052.218] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.218] WriteFile (in: hFile=0x170, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.218] SetEndOfFile (hFile=0x170) returned 1 [0052.219] CloseHandle (hObject=0x170) returned 1 [0052.224] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.224] SetEndOfFile (hFile=0x16c) returned 1 [0052.226] CloseHandle (hObject=0x16c) returned 1 [0052.226] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x26) returned 1 [0052.226] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0052.227] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.227] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.227] lstrlenW (lpString=".doc") returned 4 [0052.227] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0052.227] lstrlenW (lpString=".docx") returned 5 [0052.227] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0052.227] lstrlenW (lpString=".pdf") returned 4 [0052.227] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0052.227] lstrlenW (lpString=".xls") returned 4 [0052.227] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0052.227] lstrlenW (lpString=".xlsx") returned 5 [0052.227] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0052.227] lstrlenW (lpString=".ppt") returned 4 [0052.227] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0052.227] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.227] lstrlenW (lpString=".zip") returned 4 [0052.227] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0052.227] lstrlenW (lpString=".rar") returned 4 [0052.227] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0052.227] lstrlenW (lpString=".bz2") returned 4 [0052.227] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0052.227] lstrlenW (lpString=".7z") returned 3 [0052.227] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0052.228] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.228] lstrlenW (lpString=".dbf") returned 4 [0052.228] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0052.228] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.228] lstrlenW (lpString=".1cd") returned 4 [0052.228] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0052.228] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.228] lstrlenW (lpString=".jpg") returned 4 [0052.228] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0052.228] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.228] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.228] lstrlenW (lpString=".doc") returned 4 [0052.228] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0052.228] lstrlenW (lpString=".docx") returned 5 [0052.228] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0052.228] lstrlenW (lpString=".pdf") returned 4 [0052.228] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0052.228] lstrlenW (lpString=".xls") returned 4 [0052.228] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0052.228] lstrlenW (lpString=".xlsx") returned 5 [0052.228] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0052.228] lstrlenW (lpString=".ppt") returned 4 [0052.228] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0052.228] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.228] lstrlenW (lpString=".zip") returned 4 [0052.228] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0052.228] lstrlenW (lpString=".rar") returned 4 [0052.228] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0052.228] lstrlenW (lpString=".bz2") returned 4 [0052.229] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0052.229] lstrlenW (lpString=".7z") returned 3 [0052.229] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0052.229] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.229] lstrlenW (lpString=".dbf") returned 4 [0052.229] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0052.229] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.229] lstrlenW (lpString=".1cd") returned 4 [0052.229] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0052.229] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.229] lstrlenW (lpString=".jpg") returned 4 [0052.229] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0052.229] lstrcmpiW (lpString1=".BAK", lpString2=".beets") returned -1 [0052.229] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0052.229] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.232] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=8192) returned 1 [0052.232] CloseHandle (hObject=0x16c) returned 1 [0052.232] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0052.232] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\bootsect.bak.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.232] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0052.233] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.233] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.233] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.233] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\bootsect.bak.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.233] GetLastError () returned 0x0 [0052.233] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x2000, lpOverlapped=0x0) returned 1 [0052.322] WriteFile (in: hFile=0x170, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0052.323] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.323] WriteFile (in: hFile=0x170, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.324] SetEndOfFile (hFile=0x170) returned 1 [0052.324] CloseHandle (hObject=0x170) returned 1 [0052.329] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.329] SetEndOfFile (hFile=0x16c) returned 1 [0052.330] CloseHandle (hObject=0x16c) returned 1 [0052.330] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x27) returned 1 [0052.330] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0052.330] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.330] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.330] lstrlenW (lpString=".doc") returned 4 [0052.330] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0052.330] lstrlenW (lpString=".docx") returned 5 [0052.330] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0052.331] lstrlenW (lpString=".pdf") returned 4 [0052.331] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0052.331] lstrlenW (lpString=".xls") returned 4 [0052.331] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0052.331] lstrlenW (lpString=".xlsx") returned 5 [0052.331] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0052.331] lstrlenW (lpString=".ppt") returned 4 [0052.331] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0052.331] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.331] lstrlenW (lpString=".zip") returned 4 [0052.331] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0052.331] lstrlenW (lpString=".rar") returned 4 [0052.331] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0052.331] lstrlenW (lpString=".bz2") returned 4 [0052.331] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0052.331] lstrlenW (lpString=".7z") returned 3 [0052.331] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0052.331] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.331] lstrlenW (lpString=".dbf") returned 4 [0052.331] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0052.331] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.331] lstrlenW (lpString=".1cd") returned 4 [0052.331] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0052.331] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.331] lstrlenW (lpString=".jpg") returned 4 [0052.331] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0052.331] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.332] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.332] lstrlenW (lpString=".doc") returned 4 [0052.332] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0052.332] lstrlenW (lpString=".docx") returned 5 [0052.332] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0052.332] lstrlenW (lpString=".pdf") returned 4 [0052.332] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0052.332] lstrlenW (lpString=".xls") returned 4 [0052.332] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0052.332] lstrlenW (lpString=".xlsx") returned 5 [0052.332] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0052.332] lstrlenW (lpString=".ppt") returned 4 [0052.332] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0052.332] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.332] lstrlenW (lpString=".zip") returned 4 [0052.332] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0052.332] lstrlenW (lpString=".rar") returned 4 [0052.332] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0052.332] lstrlenW (lpString=".bz2") returned 4 [0052.332] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0052.332] lstrlenW (lpString=".7z") returned 3 [0052.332] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0052.332] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.332] lstrlenW (lpString=".dbf") returned 4 [0052.332] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0052.332] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.332] lstrlenW (lpString=".1cd") returned 4 [0052.332] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0052.332] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.332] lstrlenW (lpString=".jpg") returned 4 [0052.333] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0052.333] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0052.333] lstrlenW (lpString="Setup.xml") returned 9 [0052.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.333] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1886) returned 1 [0052.333] CloseHandle (hObject=0x16c) returned 1 [0052.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0052.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.334] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.334] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.334] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x75e, lpOverlapped=0x0) returned 1 [0052.352] WriteFile (in: hFile=0x170, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x760, lpOverlapped=0x0) returned 1 [0052.353] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.353] WriteFile (in: hFile=0x170, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.353] SetEndOfFile (hFile=0x170) returned 1 [0052.353] CloseHandle (hObject=0x170) returned 1 [0052.356] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.356] SetEndOfFile (hFile=0x16c) returned 1 [0052.357] CloseHandle (hObject=0x16c) returned 1 [0052.357] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0052.357] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0052.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.358] lstrlenW (lpString=".doc") returned 4 [0052.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.358] lstrlenW (lpString=".docx") returned 5 [0052.358] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0052.358] lstrlenW (lpString=".pdf") returned 4 [0052.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.358] lstrlenW (lpString=".xls") returned 4 [0052.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.358] lstrlenW (lpString=".xlsx") returned 5 [0052.358] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0052.358] lstrlenW (lpString=".ppt") returned 4 [0052.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.358] lstrlenW (lpString=".zip") returned 4 [0052.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.358] lstrlenW (lpString=".rar") returned 4 [0052.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.358] lstrlenW (lpString=".bz2") returned 4 [0052.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.358] lstrlenW (lpString=".7z") returned 3 [0052.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.358] lstrlenW (lpString=".dbf") returned 4 [0052.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.358] lstrlenW (lpString=".1cd") returned 4 [0052.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.359] lstrlenW (lpString=".jpg") returned 4 [0052.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.359] lstrlenW (lpString=".doc") returned 4 [0052.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.359] lstrlenW (lpString=".docx") returned 5 [0052.359] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0052.359] lstrlenW (lpString=".pdf") returned 4 [0052.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.359] lstrlenW (lpString=".xls") returned 4 [0052.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.359] lstrlenW (lpString=".xlsx") returned 5 [0052.359] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0052.359] lstrlenW (lpString=".ppt") returned 4 [0052.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.359] lstrlenW (lpString=".zip") returned 4 [0052.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.359] lstrlenW (lpString=".rar") returned 4 [0052.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.359] lstrlenW (lpString=".bz2") returned 4 [0052.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.359] lstrlenW (lpString=".7z") returned 3 [0052.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.360] lstrlenW (lpString=".dbf") returned 4 [0052.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.360] lstrlenW (lpString=".1cd") returned 4 [0052.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.360] lstrlenW (lpString=".jpg") returned 4 [0052.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.360] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0052.360] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0052.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.365] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1450) returned 1 [0052.365] CloseHandle (hObject=0x17c) returned 1 [0052.365] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0052.365] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.365] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.365] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.365] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.365] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.365] GetLastError () returned 0x0 [0052.366] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0052.367] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0052.368] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.368] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0052.368] SetEndOfFile (hFile=0x16c) returned 1 [0052.369] CloseHandle (hObject=0x16c) returned 1 [0052.372] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.372] SetEndOfFile (hFile=0x17c) returned 1 [0052.373] CloseHandle (hObject=0x17c) returned 1 [0052.373] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0052.374] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0052.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.374] lstrlenW (lpString=".doc") returned 4 [0052.374] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.374] lstrlenW (lpString=".docx") returned 5 [0052.374] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0052.374] lstrlenW (lpString=".pdf") returned 4 [0052.374] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.374] lstrlenW (lpString=".xls") returned 4 [0052.374] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.374] lstrlenW (lpString=".xlsx") returned 5 [0052.374] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0052.374] lstrlenW (lpString=".ppt") returned 4 [0052.374] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.374] lstrlenW (lpString=".zip") returned 4 [0052.374] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.375] lstrlenW (lpString=".rar") returned 4 [0052.375] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.375] lstrlenW (lpString=".bz2") returned 4 [0052.375] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.375] lstrlenW (lpString=".7z") returned 3 [0052.375] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.375] lstrlenW (lpString=".dbf") returned 4 [0052.375] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.375] lstrlenW (lpString=".1cd") returned 4 [0052.375] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.375] lstrlenW (lpString=".jpg") returned 4 [0052.375] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.375] lstrlenW (lpString=".doc") returned 4 [0052.375] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.375] lstrlenW (lpString=".docx") returned 5 [0052.375] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0052.375] lstrlenW (lpString=".pdf") returned 4 [0052.375] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.375] lstrlenW (lpString=".xls") returned 4 [0052.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.376] lstrlenW (lpString=".xlsx") returned 5 [0052.376] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0052.376] lstrlenW (lpString=".ppt") returned 4 [0052.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.376] lstrlenW (lpString=".zip") returned 4 [0052.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.376] lstrlenW (lpString=".rar") returned 4 [0052.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.376] lstrlenW (lpString=".bz2") returned 4 [0052.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.376] lstrlenW (lpString=".7z") returned 3 [0052.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.376] lstrlenW (lpString=".dbf") returned 4 [0052.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.376] lstrlenW (lpString=".1cd") returned 4 [0052.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0052.376] lstrlenW (lpString=".jpg") returned 4 [0052.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.377] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0052.377] lstrlenW (lpString="Setup.xml") returned 9 [0052.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.378] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1608) returned 1 [0052.378] CloseHandle (hObject=0x17c) returned 1 [0052.378] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0052.378] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.378] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.378] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.381] GetLastError () returned 0x0 [0052.381] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x648, lpOverlapped=0x0) returned 1 [0052.761] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x650, lpOverlapped=0x0) returned 1 [0052.762] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.762] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.762] SetEndOfFile (hFile=0x16c) returned 1 [0052.763] CloseHandle (hObject=0x16c) returned 1 [0052.768] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.768] SetEndOfFile (hFile=0x17c) returned 1 [0052.769] CloseHandle (hObject=0x17c) returned 1 [0052.769] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0052.770] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0052.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.770] lstrlenW (lpString=".doc") returned 4 [0052.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.770] lstrlenW (lpString=".docx") returned 5 [0052.770] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0052.770] lstrlenW (lpString=".pdf") returned 4 [0052.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.770] lstrlenW (lpString=".xls") returned 4 [0052.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.770] lstrlenW (lpString=".xlsx") returned 5 [0052.771] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0052.771] lstrlenW (lpString=".ppt") returned 4 [0052.771] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.771] lstrlenW (lpString=".zip") returned 4 [0052.771] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.771] lstrlenW (lpString=".rar") returned 4 [0052.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.771] lstrlenW (lpString=".bz2") returned 4 [0052.771] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.771] lstrlenW (lpString=".7z") returned 3 [0052.771] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.771] lstrlenW (lpString=".dbf") returned 4 [0052.771] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.771] lstrlenW (lpString=".1cd") returned 4 [0052.771] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.771] lstrlenW (lpString=".jpg") returned 4 [0052.772] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.772] lstrlenW (lpString=".doc") returned 4 [0052.772] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.772] lstrlenW (lpString=".docx") returned 5 [0052.772] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0052.772] lstrlenW (lpString=".pdf") returned 4 [0052.772] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.772] lstrlenW (lpString=".xls") returned 4 [0052.772] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.772] lstrlenW (lpString=".xlsx") returned 5 [0052.773] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0052.773] lstrlenW (lpString=".ppt") returned 4 [0052.773] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.773] lstrlenW (lpString=".zip") returned 4 [0052.773] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.773] lstrlenW (lpString=".rar") returned 4 [0052.773] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.773] lstrlenW (lpString=".bz2") returned 4 [0052.773] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.773] lstrlenW (lpString=".7z") returned 3 [0052.773] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.773] lstrlenW (lpString=".dbf") returned 4 [0052.773] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.773] lstrlenW (lpString=".1cd") returned 4 [0052.773] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.773] lstrlenW (lpString=".jpg") returned 4 [0052.773] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.774] Sleep (dwMilliseconds=0x64) [0053.049] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.049] lstrlenW (lpString="WordMUI.xml") returned 11 [0053.049] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.109] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1800) returned 1 [0053.109] CloseHandle (hObject=0x1a4) returned 1 [0053.110] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0053.110] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.110] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.110] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0053.110] GetLastError () returned 0x0 [0053.110] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x708, lpOverlapped=0x0) returned 1 [0053.833] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x710, lpOverlapped=0x0) returned 1 [0053.834] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.834] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.834] SetEndOfFile (hFile=0x1a8) returned 1 [0053.835] CloseHandle (hObject=0x1a8) returned 1 [0053.835] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.835] SetEndOfFile (hFile=0x1a4) returned 1 [0053.836] CloseHandle (hObject=0x1a4) returned 1 [0053.836] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0053.837] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0053.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.837] lstrlenW (lpString=".doc") returned 4 [0053.837] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.837] lstrlenW (lpString=".docx") returned 5 [0053.837] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0053.837] lstrlenW (lpString=".pdf") returned 4 [0053.837] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.837] lstrlenW (lpString=".xls") returned 4 [0053.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.837] lstrlenW (lpString=".xlsx") returned 5 [0053.837] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0053.837] lstrlenW (lpString=".ppt") returned 4 [0053.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.837] lstrlenW (lpString=".zip") returned 4 [0053.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.837] lstrlenW (lpString=".rar") returned 4 [0053.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.837] lstrlenW (lpString=".bz2") returned 4 [0053.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.838] lstrlenW (lpString=".7z") returned 3 [0053.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.838] lstrlenW (lpString=".dbf") returned 4 [0053.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.838] lstrlenW (lpString=".1cd") returned 4 [0053.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.838] lstrlenW (lpString=".jpg") returned 4 [0053.838] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.838] lstrlenW (lpString=".doc") returned 4 [0053.838] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.838] lstrlenW (lpString=".docx") returned 5 [0053.838] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0053.838] lstrlenW (lpString=".pdf") returned 4 [0053.838] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.838] lstrlenW (lpString=".xls") returned 4 [0053.838] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.838] lstrlenW (lpString=".xlsx") returned 5 [0053.838] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0053.838] lstrlenW (lpString=".ppt") returned 4 [0053.838] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.838] lstrlenW (lpString=".zip") returned 4 [0053.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.839] lstrlenW (lpString=".rar") returned 4 [0053.839] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.839] lstrlenW (lpString=".bz2") returned 4 [0053.839] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.839] lstrlenW (lpString=".7z") returned 3 [0053.839] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.839] lstrlenW (lpString=".dbf") returned 4 [0053.839] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.839] lstrlenW (lpString=".1cd") returned 4 [0053.839] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0053.839] lstrlenW (lpString=".jpg") returned 4 [0053.839] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.839] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.839] lstrlenW (lpString="Setup.xml") returned 9 [0053.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.840] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2362) returned 1 [0053.840] CloseHandle (hObject=0x1a4) returned 1 [0053.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.840] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.840] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0053.840] GetLastError () returned 0x0 [0053.840] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x93a, lpOverlapped=0x0) returned 1 [0054.038] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x940, lpOverlapped=0x0) returned 1 [0054.039] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.039] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.039] SetEndOfFile (hFile=0x1a8) returned 1 [0054.039] CloseHandle (hObject=0x1a8) returned 1 [0054.044] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.044] SetEndOfFile (hFile=0x1a4) returned 1 [0054.045] CloseHandle (hObject=0x1a4) returned 1 [0054.045] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.045] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.046] lstrlenW (lpString=".doc") returned 4 [0054.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.046] lstrlenW (lpString=".docx") returned 5 [0054.046] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.046] lstrlenW (lpString=".pdf") returned 4 [0054.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.046] lstrlenW (lpString=".xls") returned 4 [0054.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.046] lstrlenW (lpString=".xlsx") returned 5 [0054.046] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.046] lstrlenW (lpString=".ppt") returned 4 [0054.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.046] lstrlenW (lpString=".zip") returned 4 [0054.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.046] lstrlenW (lpString=".rar") returned 4 [0054.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.046] lstrlenW (lpString=".bz2") returned 4 [0054.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.046] lstrlenW (lpString=".7z") returned 3 [0054.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.046] lstrlenW (lpString=".dbf") returned 4 [0054.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.047] lstrlenW (lpString=".1cd") returned 4 [0054.047] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.047] lstrlenW (lpString=".jpg") returned 4 [0054.047] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.047] lstrlenW (lpString=".doc") returned 4 [0054.047] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.047] lstrlenW (lpString=".docx") returned 5 [0054.047] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.047] lstrlenW (lpString=".pdf") returned 4 [0054.047] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.047] lstrlenW (lpString=".xls") returned 4 [0054.047] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.047] lstrlenW (lpString=".xlsx") returned 5 [0054.047] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.047] lstrlenW (lpString=".ppt") returned 4 [0054.047] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.047] lstrlenW (lpString=".zip") returned 4 [0054.047] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.047] lstrlenW (lpString=".rar") returned 4 [0054.047] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.047] lstrlenW (lpString=".bz2") returned 4 [0054.048] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.048] lstrlenW (lpString=".7z") returned 3 [0054.048] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.048] lstrlenW (lpString=".dbf") returned 4 [0054.048] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.048] lstrlenW (lpString=".1cd") returned 4 [0054.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.048] lstrlenW (lpString=".jpg") returned 4 [0054.048] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.048] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.048] lstrlenW (lpString="Setup.xml") returned 9 [0054.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0054.051] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=6241) returned 1 [0054.051] CloseHandle (hObject=0x1a4) returned 1 [0054.051] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.051] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0054.051] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.052] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0054.056] GetLastError () returned 0x0 [0054.056] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x1861, lpOverlapped=0x0) returned 1 [0054.095] WriteFile (in: hFile=0x1b4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0054.097] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.097] WriteFile (in: hFile=0x1b4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.097] SetEndOfFile (hFile=0x1b4) returned 1 [0054.097] CloseHandle (hObject=0x1b4) returned 1 [0054.098] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.098] SetEndOfFile (hFile=0x1a4) returned 1 [0054.099] CloseHandle (hObject=0x1a4) returned 1 [0054.099] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.100] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.100] lstrlenW (lpString=".doc") returned 4 [0054.100] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.100] lstrlenW (lpString=".docx") returned 5 [0054.100] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.100] lstrlenW (lpString=".pdf") returned 4 [0054.100] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.100] lstrlenW (lpString=".xls") returned 4 [0054.100] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.100] lstrlenW (lpString=".xlsx") returned 5 [0054.100] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.100] lstrlenW (lpString=".ppt") returned 4 [0054.101] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.101] lstrlenW (lpString=".zip") returned 4 [0054.101] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.101] lstrlenW (lpString=".rar") returned 4 [0054.101] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.101] lstrlenW (lpString=".bz2") returned 4 [0054.101] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.101] lstrlenW (lpString=".7z") returned 3 [0054.101] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.101] lstrlenW (lpString=".dbf") returned 4 [0054.101] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.101] lstrlenW (lpString=".1cd") returned 4 [0054.101] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.101] lstrlenW (lpString=".jpg") returned 4 [0054.101] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.101] lstrlenW (lpString=".doc") returned 4 [0054.101] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.101] lstrlenW (lpString=".docx") returned 5 [0054.101] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.101] lstrlenW (lpString=".pdf") returned 4 [0054.101] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.102] lstrlenW (lpString=".xls") returned 4 [0054.102] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.102] lstrlenW (lpString=".xlsx") returned 5 [0054.102] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.102] lstrlenW (lpString=".ppt") returned 4 [0054.102] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.102] lstrlenW (lpString=".zip") returned 4 [0054.102] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.102] lstrlenW (lpString=".rar") returned 4 [0054.102] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.102] lstrlenW (lpString=".bz2") returned 4 [0054.102] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.102] lstrlenW (lpString=".7z") returned 3 [0054.102] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.102] lstrlenW (lpString=".dbf") returned 4 [0054.102] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.102] lstrlenW (lpString=".1cd") returned 4 [0054.102] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.102] lstrlenW (lpString=".jpg") returned 4 [0054.102] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.103] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.103] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0054.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0054.104] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1606) returned 1 [0054.104] CloseHandle (hObject=0x1a4) returned 1 [0054.104] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0054.104] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0054.105] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.105] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0054.105] GetLastError () returned 0x0 [0054.105] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x646, lpOverlapped=0x0) returned 1 [0054.320] WriteFile (in: hFile=0x1b4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x650, lpOverlapped=0x0) returned 1 [0054.321] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.321] WriteFile (in: hFile=0x1b4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0054.321] SetEndOfFile (hFile=0x1b4) returned 1 [0054.321] CloseHandle (hObject=0x1b4) returned 1 [0054.322] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.322] SetEndOfFile (hFile=0x1a4) returned 1 [0054.323] CloseHandle (hObject=0x1a4) returned 1 [0054.323] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.323] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0055.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.118] lstrlenW (lpString=".doc") returned 4 [0055.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.118] lstrlenW (lpString=".docx") returned 5 [0055.118] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0055.118] lstrlenW (lpString=".pdf") returned 4 [0055.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.118] lstrlenW (lpString=".xls") returned 4 [0055.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.118] lstrlenW (lpString=".xlsx") returned 5 [0055.118] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0055.118] lstrlenW (lpString=".ppt") returned 4 [0055.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.118] lstrlenW (lpString=".zip") returned 4 [0055.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.118] lstrlenW (lpString=".rar") returned 4 [0055.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.118] lstrlenW (lpString=".bz2") returned 4 [0055.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.118] lstrlenW (lpString=".7z") returned 3 [0055.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.118] lstrlenW (lpString=".dbf") returned 4 [0055.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.118] lstrlenW (lpString=".1cd") returned 4 [0055.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.119] lstrlenW (lpString=".jpg") returned 4 [0055.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.119] lstrlenW (lpString=".doc") returned 4 [0055.119] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString=".docx") returned 5 [0055.119] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0055.119] lstrlenW (lpString=".pdf") returned 4 [0055.119] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString=".xls") returned 4 [0055.119] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString=".xlsx") returned 5 [0055.119] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0055.119] lstrlenW (lpString=".ppt") returned 4 [0055.119] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.119] lstrlenW (lpString=".zip") returned 4 [0055.119] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.119] lstrlenW (lpString=".rar") returned 4 [0055.119] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString=".bz2") returned 4 [0055.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString=".7z") returned 3 [0055.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.119] lstrlenW (lpString=".dbf") returned 4 [0055.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.119] lstrlenW (lpString=".1cd") returned 4 [0055.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0055.119] lstrlenW (lpString=".jpg") returned 4 [0055.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.120] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.120] lstrlenW (lpString="Setup.xml") returned 9 [0055.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0055.120] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=9352) returned 1 [0055.120] CloseHandle (hObject=0x1c4) returned 1 [0055.120] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0055.120] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0055.120] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.120] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0055.121] GetLastError () returned 0x0 [0055.121] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x2488, lpOverlapped=0x0) returned 1 [0055.145] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0055.146] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.146] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.146] SetEndOfFile (hFile=0x1c8) returned 1 [0055.147] CloseHandle (hObject=0x1c8) returned 1 [0055.147] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.148] SetEndOfFile (hFile=0x1c4) returned 1 [0055.149] CloseHandle (hObject=0x1c4) returned 1 [0055.149] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.150] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0055.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.150] lstrlenW (lpString=".doc") returned 4 [0055.150] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.150] lstrlenW (lpString=".docx") returned 5 [0055.150] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0055.150] lstrlenW (lpString=".pdf") returned 4 [0055.150] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.150] lstrlenW (lpString=".xls") returned 4 [0055.150] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.150] lstrlenW (lpString=".xlsx") returned 5 [0055.150] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0055.150] lstrlenW (lpString=".ppt") returned 4 [0055.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.151] lstrlenW (lpString=".zip") returned 4 [0055.151] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.151] lstrlenW (lpString=".rar") returned 4 [0055.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.151] lstrlenW (lpString=".bz2") returned 4 [0055.151] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.151] lstrlenW (lpString=".7z") returned 3 [0055.151] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.151] lstrlenW (lpString=".dbf") returned 4 [0055.151] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.151] lstrlenW (lpString=".1cd") returned 4 [0055.151] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.151] lstrlenW (lpString=".jpg") returned 4 [0055.151] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.151] lstrlenW (lpString=".doc") returned 4 [0055.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.151] lstrlenW (lpString=".docx") returned 5 [0055.151] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0055.151] lstrlenW (lpString=".pdf") returned 4 [0055.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.152] lstrlenW (lpString=".xls") returned 4 [0055.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.152] lstrlenW (lpString=".xlsx") returned 5 [0055.152] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0055.152] lstrlenW (lpString=".ppt") returned 4 [0055.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.152] lstrlenW (lpString=".zip") returned 4 [0055.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.152] lstrlenW (lpString=".rar") returned 4 [0055.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.152] lstrlenW (lpString=".bz2") returned 4 [0055.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.152] lstrlenW (lpString=".7z") returned 3 [0055.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.152] lstrlenW (lpString=".dbf") returned 4 [0055.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.152] lstrlenW (lpString=".1cd") returned 4 [0055.152] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.152] lstrlenW (lpString=".jpg") returned 4 [0055.152] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.152] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.153] lstrlenW (lpString="branding.xml") returned 12 [0055.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0055.153] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=596341) returned 1 [0055.153] CloseHandle (hObject=0x1c4) returned 1 [0055.153] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0055.153] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0055.153] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.153] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0055.154] GetLastError () returned 0x0 [0055.154] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x91975, lpOverlapped=0x0) returned 1 [0055.809] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0056.008] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.008] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.008] SetEndOfFile (hFile=0x1c8) returned 1 [0056.008] CloseHandle (hObject=0x1c8) returned 1 [0056.014] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.014] SetEndOfFile (hFile=0x1c4) returned 1 [0056.020] CloseHandle (hObject=0x1c4) returned 1 [0056.020] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.020] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0056.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.021] lstrlenW (lpString=".doc") returned 4 [0056.021] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.021] lstrlenW (lpString=".docx") returned 5 [0056.021] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0056.021] lstrlenW (lpString=".pdf") returned 4 [0056.021] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.021] lstrlenW (lpString=".xls") returned 4 [0056.021] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.021] lstrlenW (lpString=".xlsx") returned 5 [0056.021] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0056.021] lstrlenW (lpString=".ppt") returned 4 [0056.021] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.021] lstrlenW (lpString=".zip") returned 4 [0056.021] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.021] lstrlenW (lpString=".rar") returned 4 [0056.021] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.021] lstrlenW (lpString=".bz2") returned 4 [0056.021] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.021] lstrlenW (lpString=".7z") returned 3 [0056.021] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.021] lstrlenW (lpString=".dbf") returned 4 [0056.021] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.021] lstrlenW (lpString=".1cd") returned 4 [0056.021] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.021] lstrlenW (lpString=".jpg") returned 4 [0056.021] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.022] lstrlenW (lpString=".doc") returned 4 [0056.022] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.022] lstrlenW (lpString=".docx") returned 5 [0056.022] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0056.022] lstrlenW (lpString=".pdf") returned 4 [0056.022] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.022] lstrlenW (lpString=".xls") returned 4 [0056.022] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.022] lstrlenW (lpString=".xlsx") returned 5 [0056.022] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0056.022] lstrlenW (lpString=".ppt") returned 4 [0056.022] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.022] lstrlenW (lpString=".zip") returned 4 [0056.022] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.022] lstrlenW (lpString=".rar") returned 4 [0056.022] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.022] lstrlenW (lpString=".bz2") returned 4 [0056.022] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.022] lstrlenW (lpString=".7z") returned 3 [0056.022] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.022] lstrlenW (lpString=".dbf") returned 4 [0056.022] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.022] lstrlenW (lpString=".1cd") returned 4 [0056.022] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0056.023] lstrlenW (lpString=".jpg") returned 4 [0056.023] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.023] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.023] lstrlenW (lpString="Setup.xml") returned 9 [0056.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.024] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=31094) returned 1 [0056.024] CloseHandle (hObject=0x1c4) returned 1 [0056.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0056.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.024] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.024] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0056.025] GetLastError () returned 0x0 [0056.025] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x7976, lpOverlapped=0x0) returned 1 [0056.280] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0056.281] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.281] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.281] SetEndOfFile (hFile=0x1c8) returned 1 [0056.281] CloseHandle (hObject=0x1c8) returned 1 [0056.282] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.282] SetEndOfFile (hFile=0x1c4) returned 1 [0056.283] CloseHandle (hObject=0x1c4) returned 1 [0056.283] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.283] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0056.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.283] lstrlenW (lpString=".doc") returned 4 [0056.283] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString=".docx") returned 5 [0056.284] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0056.284] lstrlenW (lpString=".pdf") returned 4 [0056.284] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString=".xls") returned 4 [0056.284] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString=".xlsx") returned 5 [0056.284] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0056.284] lstrlenW (lpString=".ppt") returned 4 [0056.284] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.284] lstrlenW (lpString=".zip") returned 4 [0056.284] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.284] lstrlenW (lpString=".rar") returned 4 [0056.284] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString=".bz2") returned 4 [0056.284] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString=".7z") returned 3 [0056.284] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.284] lstrlenW (lpString=".dbf") returned 4 [0056.284] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.284] lstrlenW (lpString=".1cd") returned 4 [0056.284] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.284] lstrlenW (lpString=".jpg") returned 4 [0056.284] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.284] lstrlenW (lpString=".doc") returned 4 [0056.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.285] lstrlenW (lpString=".docx") returned 5 [0056.285] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0056.285] lstrlenW (lpString=".pdf") returned 4 [0056.285] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.285] lstrlenW (lpString=".xls") returned 4 [0056.285] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.285] lstrlenW (lpString=".xlsx") returned 5 [0056.285] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0056.285] lstrlenW (lpString=".ppt") returned 4 [0056.285] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.285] lstrlenW (lpString=".zip") returned 4 [0056.285] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.285] lstrlenW (lpString=".rar") returned 4 [0056.285] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.285] lstrlenW (lpString=".bz2") returned 4 [0056.285] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.285] lstrlenW (lpString=".7z") returned 3 [0056.285] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.285] lstrlenW (lpString=".dbf") returned 4 [0056.285] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.285] lstrlenW (lpString=".1cd") returned 4 [0056.285] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.285] lstrlenW (lpString=".jpg") returned 4 [0056.285] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.286] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.286] lstrlenW (lpString="Setup.xml") returned 9 [0056.286] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.286] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=16683) returned 1 [0056.286] CloseHandle (hObject=0x1c4) returned 1 [0056.286] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0056.286] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.286] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.286] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.286] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.287] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0056.287] GetLastError () returned 0x0 [0056.287] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x412b, lpOverlapped=0x0) returned 1 [0056.419] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0056.420] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.420] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.420] SetEndOfFile (hFile=0x1c8) returned 1 [0056.420] CloseHandle (hObject=0x1c8) returned 1 [0056.423] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.423] SetEndOfFile (hFile=0x1c4) returned 1 [0056.424] CloseHandle (hObject=0x1c4) returned 1 [0056.424] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.424] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0056.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.425] lstrlenW (lpString=".doc") returned 4 [0056.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.425] lstrlenW (lpString=".docx") returned 5 [0056.425] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0056.425] lstrlenW (lpString=".pdf") returned 4 [0056.425] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.425] lstrlenW (lpString=".xls") returned 4 [0056.425] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.425] lstrlenW (lpString=".xlsx") returned 5 [0056.425] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0056.425] lstrlenW (lpString=".ppt") returned 4 [0056.425] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.426] lstrlenW (lpString=".zip") returned 4 [0056.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.426] lstrlenW (lpString=".rar") returned 4 [0056.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.426] lstrlenW (lpString=".bz2") returned 4 [0056.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.426] lstrlenW (lpString=".7z") returned 3 [0056.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.426] lstrlenW (lpString=".dbf") returned 4 [0056.426] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.426] lstrlenW (lpString=".1cd") returned 4 [0056.426] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.426] lstrlenW (lpString=".jpg") returned 4 [0056.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.426] lstrlenW (lpString=".doc") returned 4 [0056.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.426] lstrlenW (lpString=".docx") returned 5 [0056.426] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0056.427] lstrlenW (lpString=".pdf") returned 4 [0056.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.427] lstrlenW (lpString=".xls") returned 4 [0056.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.427] lstrlenW (lpString=".xlsx") returned 5 [0056.427] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0056.427] lstrlenW (lpString=".ppt") returned 4 [0056.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.427] lstrlenW (lpString=".zip") returned 4 [0056.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.427] lstrlenW (lpString=".rar") returned 4 [0056.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.427] lstrlenW (lpString=".bz2") returned 4 [0056.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.427] lstrlenW (lpString=".7z") returned 3 [0056.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.427] lstrlenW (lpString=".dbf") returned 4 [0056.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.427] lstrlenW (lpString=".1cd") returned 4 [0056.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.427] lstrlenW (lpString=".jpg") returned 4 [0056.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.428] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.428] lstrlenW (lpString="Office32WW.xml") returned 14 [0056.428] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.429] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4274) returned 1 [0056.429] CloseHandle (hObject=0x1c4) returned 1 [0056.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0056.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.429] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.429] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0056.429] GetLastError () returned 0x0 [0056.430] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0056.541] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0056.542] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.542] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0056.542] SetEndOfFile (hFile=0x1c8) returned 1 [0056.542] CloseHandle (hObject=0x1c8) returned 1 [0056.544] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.544] SetEndOfFile (hFile=0x1c4) returned 1 [0056.545] CloseHandle (hObject=0x1c4) returned 1 [0056.545] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.545] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0056.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.546] lstrlenW (lpString=".doc") returned 4 [0056.546] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.546] lstrlenW (lpString=".docx") returned 5 [0056.546] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.546] lstrlenW (lpString=".pdf") returned 4 [0056.546] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.546] lstrlenW (lpString=".xls") returned 4 [0056.546] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.546] lstrlenW (lpString=".xlsx") returned 5 [0056.546] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.546] lstrlenW (lpString=".ppt") returned 4 [0056.546] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.546] lstrlenW (lpString=".zip") returned 4 [0056.546] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.546] lstrlenW (lpString=".rar") returned 4 [0056.546] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.546] lstrlenW (lpString=".bz2") returned 4 [0056.546] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.546] lstrlenW (lpString=".7z") returned 3 [0056.546] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.546] lstrlenW (lpString=".dbf") returned 4 [0056.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.546] lstrlenW (lpString=".1cd") returned 4 [0056.546] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.546] lstrlenW (lpString=".jpg") returned 4 [0056.547] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.547] lstrlenW (lpString=".doc") returned 4 [0056.547] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.547] lstrlenW (lpString=".docx") returned 5 [0056.547] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.547] lstrlenW (lpString=".pdf") returned 4 [0056.547] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.547] lstrlenW (lpString=".xls") returned 4 [0056.547] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.547] lstrlenW (lpString=".xlsx") returned 5 [0056.547] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.547] lstrlenW (lpString=".ppt") returned 4 [0056.547] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.547] lstrlenW (lpString=".zip") returned 4 [0056.547] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.547] lstrlenW (lpString=".rar") returned 4 [0056.547] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.547] lstrlenW (lpString=".bz2") returned 4 [0056.547] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.547] lstrlenW (lpString=".7z") returned 3 [0056.547] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.547] lstrlenW (lpString=".dbf") returned 4 [0056.547] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.547] lstrlenW (lpString=".1cd") returned 4 [0056.548] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.548] lstrlenW (lpString=".jpg") returned 4 [0056.548] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.548] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.548] lstrlenW (lpString="Setup.xml") returned 9 [0056.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.548] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=20577) returned 1 [0056.548] CloseHandle (hObject=0x1c4) returned 1 [0056.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0056.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0056.549] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.549] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.549] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0056.549] GetLastError () returned 0x0 [0056.549] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5061, lpOverlapped=0x0) returned 1 [0056.856] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0056.857] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.857] WriteFile (in: hFile=0x1c8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.857] SetEndOfFile (hFile=0x1c8) returned 1 [0056.857] CloseHandle (hObject=0x1c8) returned 1 [0056.858] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.858] SetEndOfFile (hFile=0x1c4) returned 1 [0056.859] CloseHandle (hObject=0x1c4) returned 1 [0056.859] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.913] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.913] lstrlenW (lpString=".doc") returned 4 [0056.913] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.913] lstrlenW (lpString=".docx") returned 5 [0056.913] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0056.913] lstrlenW (lpString=".pdf") returned 4 [0056.913] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.913] lstrlenW (lpString=".xls") returned 4 [0056.913] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.913] lstrlenW (lpString=".xlsx") returned 5 [0056.913] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0056.913] lstrlenW (lpString=".ppt") returned 4 [0056.913] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.913] lstrlenW (lpString=".zip") returned 4 [0056.913] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.913] lstrlenW (lpString=".rar") returned 4 [0056.913] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString=".bz2") returned 4 [0056.914] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString=".7z") returned 3 [0056.914] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.914] lstrlenW (lpString=".dbf") returned 4 [0056.914] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.914] lstrlenW (lpString=".1cd") returned 4 [0056.914] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.914] lstrlenW (lpString=".jpg") returned 4 [0056.914] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.914] lstrlenW (lpString=".doc") returned 4 [0056.914] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString=".docx") returned 5 [0056.914] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0056.914] lstrlenW (lpString=".pdf") returned 4 [0056.914] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString=".xls") returned 4 [0056.914] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString=".xlsx") returned 5 [0056.914] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0056.914] lstrlenW (lpString=".ppt") returned 4 [0056.914] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.915] lstrlenW (lpString=".zip") returned 4 [0056.915] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.915] lstrlenW (lpString=".rar") returned 4 [0056.915] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.915] lstrlenW (lpString=".bz2") returned 4 [0056.915] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.915] lstrlenW (lpString=".7z") returned 3 [0056.915] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.915] lstrlenW (lpString=".dbf") returned 4 [0056.915] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.915] lstrlenW (lpString=".1cd") returned 4 [0056.915] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0056.915] lstrlenW (lpString=".jpg") returned 4 [0056.915] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.915] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.915] lstrlenW (lpString="Content.xml") returned 11 [0056.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0058.127] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27045) returned 1 [0058.127] CloseHandle (hObject=0x1c0) returned 1 [0058.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0058.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0058.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.128] lstrlenW (lpString=".doc") returned 4 [0058.128] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.128] lstrlenW (lpString=".docx") returned 5 [0058.128] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0058.128] lstrlenW (lpString=".pdf") returned 4 [0058.128] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.128] lstrlenW (lpString=".xls") returned 4 [0058.128] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.128] lstrlenW (lpString=".xlsx") returned 5 [0058.128] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0058.128] lstrlenW (lpString=".ppt") returned 4 [0058.128] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.128] lstrlenW (lpString=".zip") returned 4 [0058.128] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.128] lstrlenW (lpString=".rar") returned 4 [0058.128] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.128] lstrlenW (lpString=".bz2") returned 4 [0058.128] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.128] lstrlenW (lpString=".7z") returned 3 [0058.128] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.128] lstrlenW (lpString=".dbf") returned 4 [0058.128] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.128] lstrlenW (lpString=".1cd") returned 4 [0058.128] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.128] lstrlenW (lpString=".jpg") returned 4 [0058.128] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.129] lstrlenW (lpString=".doc") returned 4 [0058.129] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.129] lstrlenW (lpString=".docx") returned 5 [0058.129] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0058.129] lstrlenW (lpString=".pdf") returned 4 [0058.129] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.129] lstrlenW (lpString=".xls") returned 4 [0058.129] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.129] lstrlenW (lpString=".xlsx") returned 5 [0058.129] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0058.129] lstrlenW (lpString=".ppt") returned 4 [0058.129] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.129] lstrlenW (lpString=".zip") returned 4 [0058.129] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.129] lstrlenW (lpString=".rar") returned 4 [0058.129] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.129] lstrlenW (lpString=".bz2") returned 4 [0058.129] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.129] lstrlenW (lpString=".7z") returned 3 [0058.129] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.129] lstrlenW (lpString=".dbf") returned 4 [0058.129] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.129] lstrlenW (lpString=".1cd") returned 4 [0058.129] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0058.130] lstrlenW (lpString=".jpg") returned 4 [0058.130] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.130] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0058.130] lstrlenW (lpString="boxed-split.avi") returned 15 [0058.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.331] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=62976) returned 1 [0059.331] CloseHandle (hObject=0x1a4) returned 1 [0059.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0059.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.331] lstrlenW (lpString=".doc") returned 4 [0059.331] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString=".docx") returned 5 [0059.332] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0059.332] lstrlenW (lpString=".pdf") returned 4 [0059.332] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString=".xls") returned 4 [0059.332] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString=".xlsx") returned 5 [0059.332] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0059.332] lstrlenW (lpString=".ppt") returned 4 [0059.332] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.332] lstrlenW (lpString=".zip") returned 4 [0059.332] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString=".rar") returned 4 [0059.332] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString=".bz2") returned 4 [0059.332] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString=".7z") returned 3 [0059.332] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.332] lstrlenW (lpString=".dbf") returned 4 [0059.332] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.332] lstrlenW (lpString=".1cd") returned 4 [0059.332] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.332] lstrlenW (lpString=".jpg") returned 4 [0059.332] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.332] lstrlenW (lpString=".doc") returned 4 [0059.332] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.332] lstrlenW (lpString=".docx") returned 5 [0059.333] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0059.333] lstrlenW (lpString=".pdf") returned 4 [0059.333] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.333] lstrlenW (lpString=".xls") returned 4 [0059.333] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.333] lstrlenW (lpString=".xlsx") returned 5 [0059.333] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0059.333] lstrlenW (lpString=".ppt") returned 4 [0059.333] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.333] lstrlenW (lpString=".zip") returned 4 [0059.333] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.333] lstrlenW (lpString=".rar") returned 4 [0059.333] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.333] lstrlenW (lpString=".bz2") returned 4 [0059.333] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.333] lstrlenW (lpString=".7z") returned 3 [0059.333] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.333] lstrlenW (lpString=".dbf") returned 4 [0059.333] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.333] lstrlenW (lpString=".1cd") returned 4 [0059.333] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0059.333] lstrlenW (lpString=".jpg") returned 4 [0059.333] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.333] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.334] lstrlenW (lpString="keypadbase.xml") returned 14 [0059.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.502] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1118) returned 1 [0059.502] CloseHandle (hObject=0x1a4) returned 1 [0059.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0059.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.503] lstrlenW (lpString=".doc") returned 4 [0059.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.503] lstrlenW (lpString=".docx") returned 5 [0059.503] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0059.503] lstrlenW (lpString=".pdf") returned 4 [0059.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.503] lstrlenW (lpString=".xls") returned 4 [0059.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.503] lstrlenW (lpString=".xlsx") returned 5 [0059.503] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0059.503] lstrlenW (lpString=".ppt") returned 4 [0059.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.503] lstrlenW (lpString=".zip") returned 4 [0059.503] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.503] lstrlenW (lpString=".rar") returned 4 [0059.503] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.503] lstrlenW (lpString=".bz2") returned 4 [0059.503] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.503] lstrlenW (lpString=".7z") returned 3 [0059.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.503] lstrlenW (lpString=".dbf") returned 4 [0059.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.503] lstrlenW (lpString=".1cd") returned 4 [0059.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.504] lstrlenW (lpString=".jpg") returned 4 [0059.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.504] lstrlenW (lpString=".doc") returned 4 [0059.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.504] lstrlenW (lpString=".docx") returned 5 [0059.504] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0059.504] lstrlenW (lpString=".pdf") returned 4 [0059.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.504] lstrlenW (lpString=".xls") returned 4 [0059.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.504] lstrlenW (lpString=".xlsx") returned 5 [0059.504] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0059.504] lstrlenW (lpString=".ppt") returned 4 [0059.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.504] lstrlenW (lpString=".zip") returned 4 [0059.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.504] lstrlenW (lpString=".rar") returned 4 [0059.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.504] lstrlenW (lpString=".bz2") returned 4 [0059.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.504] lstrlenW (lpString=".7z") returned 3 [0059.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.504] lstrlenW (lpString=".dbf") returned 4 [0059.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.505] lstrlenW (lpString=".1cd") returned 4 [0059.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0059.505] lstrlenW (lpString=".jpg") returned 4 [0059.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.505] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.505] lstrlenW (lpString="base.xml") returned 8 [0059.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.559] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3150) returned 1 [0059.559] CloseHandle (hObject=0x1a4) returned 1 [0059.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0059.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.559] lstrlenW (lpString=".doc") returned 4 [0059.559] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.559] lstrlenW (lpString=".docx") returned 5 [0059.559] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0059.559] lstrlenW (lpString=".pdf") returned 4 [0059.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.559] lstrlenW (lpString=".xls") returned 4 [0059.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.559] lstrlenW (lpString=".xlsx") returned 5 [0059.559] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0059.559] lstrlenW (lpString=".ppt") returned 4 [0059.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.560] lstrlenW (lpString=".zip") returned 4 [0059.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.560] lstrlenW (lpString=".rar") returned 4 [0059.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.560] lstrlenW (lpString=".bz2") returned 4 [0059.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.560] lstrlenW (lpString=".7z") returned 3 [0059.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.560] lstrlenW (lpString=".dbf") returned 4 [0059.560] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.560] lstrlenW (lpString=".1cd") returned 4 [0059.560] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.560] lstrlenW (lpString=".jpg") returned 4 [0059.560] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.560] lstrlenW (lpString=".doc") returned 4 [0059.560] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.560] lstrlenW (lpString=".docx") returned 5 [0059.560] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0059.560] lstrlenW (lpString=".pdf") returned 4 [0059.560] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.560] lstrlenW (lpString=".xls") returned 4 [0059.560] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.561] lstrlenW (lpString=".xlsx") returned 5 [0059.561] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0059.561] lstrlenW (lpString=".ppt") returned 4 [0059.561] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.561] lstrlenW (lpString=".zip") returned 4 [0059.561] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.561] lstrlenW (lpString=".rar") returned 4 [0059.561] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.561] lstrlenW (lpString=".bz2") returned 4 [0059.561] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.561] lstrlenW (lpString=".7z") returned 3 [0059.561] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.561] lstrlenW (lpString=".dbf") returned 4 [0059.561] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.561] lstrlenW (lpString=".1cd") returned 4 [0059.561] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0059.561] lstrlenW (lpString=".jpg") returned 4 [0059.561] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.561] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.561] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0059.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.562] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=247) returned 1 [0059.562] CloseHandle (hObject=0x1a4) returned 1 [0059.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0059.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.562] lstrlenW (lpString=".doc") returned 4 [0059.562] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.562] lstrlenW (lpString=".docx") returned 5 [0059.562] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0059.562] lstrlenW (lpString=".pdf") returned 4 [0059.562] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.562] lstrlenW (lpString=".xls") returned 4 [0059.562] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.562] lstrlenW (lpString=".xlsx") returned 5 [0059.563] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0059.563] lstrlenW (lpString=".ppt") returned 4 [0059.563] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.563] lstrlenW (lpString=".zip") returned 4 [0059.563] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.563] lstrlenW (lpString=".rar") returned 4 [0059.563] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.563] lstrlenW (lpString=".bz2") returned 4 [0059.563] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.563] lstrlenW (lpString=".7z") returned 3 [0059.563] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.563] lstrlenW (lpString=".dbf") returned 4 [0059.563] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.563] lstrlenW (lpString=".1cd") returned 4 [0059.563] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.563] lstrlenW (lpString=".jpg") returned 4 [0059.563] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.563] lstrlenW (lpString=".doc") returned 4 [0059.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.563] lstrlenW (lpString=".docx") returned 5 [0059.563] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0059.563] lstrlenW (lpString=".pdf") returned 4 [0059.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.564] lstrlenW (lpString=".xls") returned 4 [0059.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.564] lstrlenW (lpString=".xlsx") returned 5 [0059.564] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0059.564] lstrlenW (lpString=".ppt") returned 4 [0059.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.564] lstrlenW (lpString=".zip") returned 4 [0059.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.564] lstrlenW (lpString=".rar") returned 4 [0059.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.564] lstrlenW (lpString=".bz2") returned 4 [0059.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.564] lstrlenW (lpString=".7z") returned 3 [0059.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.564] lstrlenW (lpString=".dbf") returned 4 [0059.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.564] lstrlenW (lpString=".1cd") returned 4 [0059.564] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0059.564] lstrlenW (lpString=".jpg") returned 4 [0059.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.564] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.565] lstrlenW (lpString="base_altgr.xml") returned 14 [0059.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.566] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3161) returned 1 [0059.566] CloseHandle (hObject=0x1a4) returned 1 [0059.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0059.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.566] lstrlenW (lpString=".doc") returned 4 [0059.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString=".docx") returned 5 [0059.567] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0059.567] lstrlenW (lpString=".pdf") returned 4 [0059.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString=".xls") returned 4 [0059.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString=".xlsx") returned 5 [0059.567] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0059.567] lstrlenW (lpString=".ppt") returned 4 [0059.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.567] lstrlenW (lpString=".zip") returned 4 [0059.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.567] lstrlenW (lpString=".rar") returned 4 [0059.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString=".bz2") returned 4 [0059.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString=".7z") returned 3 [0059.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.567] lstrlenW (lpString=".dbf") returned 4 [0059.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.567] lstrlenW (lpString=".1cd") returned 4 [0059.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.567] lstrlenW (lpString=".jpg") returned 4 [0059.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.568] lstrlenW (lpString=".doc") returned 4 [0059.568] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.568] lstrlenW (lpString=".docx") returned 5 [0059.568] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0059.568] lstrlenW (lpString=".pdf") returned 4 [0059.568] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.568] lstrlenW (lpString=".xls") returned 4 [0059.568] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.568] lstrlenW (lpString=".xlsx") returned 5 [0059.568] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0059.568] lstrlenW (lpString=".ppt") returned 4 [0059.568] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.568] lstrlenW (lpString=".zip") returned 4 [0059.568] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.568] lstrlenW (lpString=".rar") returned 4 [0059.568] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.568] lstrlenW (lpString=".bz2") returned 4 [0059.568] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.568] lstrlenW (lpString=".7z") returned 3 [0059.568] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.568] lstrlenW (lpString=".dbf") returned 4 [0059.568] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.568] lstrlenW (lpString=".1cd") returned 4 [0059.568] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0059.568] lstrlenW (lpString=".jpg") returned 4 [0059.569] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.569] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.569] lstrlenW (lpString="base_ca.xml") returned 11 [0059.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.569] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3166) returned 1 [0059.569] CloseHandle (hObject=0x1a4) returned 1 [0059.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0059.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.570] lstrlenW (lpString=".doc") returned 4 [0059.570] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.570] lstrlenW (lpString=".docx") returned 5 [0059.570] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0059.570] lstrlenW (lpString=".pdf") returned 4 [0059.570] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.570] lstrlenW (lpString=".xls") returned 4 [0059.570] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.570] lstrlenW (lpString=".xlsx") returned 5 [0059.570] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0059.570] lstrlenW (lpString=".ppt") returned 4 [0059.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.570] lstrlenW (lpString=".zip") returned 4 [0059.570] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.570] lstrlenW (lpString=".rar") returned 4 [0059.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.570] lstrlenW (lpString=".bz2") returned 4 [0059.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.570] lstrlenW (lpString=".7z") returned 3 [0059.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.570] lstrlenW (lpString=".dbf") returned 4 [0059.571] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.571] lstrlenW (lpString=".1cd") returned 4 [0059.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.571] lstrlenW (lpString=".jpg") returned 4 [0059.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.571] lstrlenW (lpString=".doc") returned 4 [0059.571] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.571] lstrlenW (lpString=".docx") returned 5 [0059.571] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0059.571] lstrlenW (lpString=".pdf") returned 4 [0059.571] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.571] lstrlenW (lpString=".xls") returned 4 [0059.571] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.571] lstrlenW (lpString=".xlsx") returned 5 [0059.571] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0059.571] lstrlenW (lpString=".ppt") returned 4 [0059.571] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.571] lstrlenW (lpString=".zip") returned 4 [0059.571] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.571] lstrlenW (lpString=".rar") returned 4 [0059.571] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.571] lstrlenW (lpString=".bz2") returned 4 [0059.571] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.572] lstrlenW (lpString=".7z") returned 3 [0059.572] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.572] lstrlenW (lpString=".dbf") returned 4 [0059.572] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.572] lstrlenW (lpString=".1cd") returned 4 [0059.572] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0059.572] lstrlenW (lpString=".jpg") returned 4 [0059.572] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.572] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.572] lstrlenW (lpString="base_heb.xml") returned 12 [0059.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.575] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=738) returned 1 [0059.575] CloseHandle (hObject=0x1a4) returned 1 [0059.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0059.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0059.576] lstrlenW (lpString=".doc") returned 4 [0059.576] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.576] lstrlenW (lpString=".docx") returned 5 [0059.576] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0059.576] lstrlenW (lpString=".pdf") returned 4 [0059.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.576] lstrlenW (lpString=".xls") returned 4 [0059.576] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.576] lstrlenW (lpString=".xlsx") returned 5 [0059.576] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0059.576] lstrlenW (lpString=".ppt") returned 4 [0059.576] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0059.576] lstrlenW (lpString=".zip") returned 4 [0059.576] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.576] lstrlenW (lpString=".rar") returned 4 [0059.576] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.576] lstrlenW (lpString=".bz2") returned 4 [0059.576] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.576] lstrlenW (lpString=".7z") returned 3 [0059.576] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0059.576] lstrlenW (lpString=".dbf") returned 4 [0059.576] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0061.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0061.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.214] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.215] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.215] ReadFile (in: hFile=0x190, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.259] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.260] ReadFile (in: hFile=0x190, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c7fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.354] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.354] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.354] ReadFile (in: hFile=0x190, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c7fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.558] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.558] WriteFile (in: hFile=0x190, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2c7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0061.750] SetEndOfFile (hFile=0x190) returned 1 [0061.751] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3fa4090 [0061.757] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.757] WriteFile (in: hFile=0x190, lpBuffer=0x3fa4090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4090*, lpNumberOfBytesWritten=0x2c7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.759] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.759] WriteFile (in: hFile=0x190, lpBuffer=0x3fa4090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4090*, lpNumberOfBytesWritten=0x2c7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.777] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.777] WriteFile (in: hFile=0x190, lpBuffer=0x3fa4090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4090*, lpNumberOfBytesWritten=0x2c7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.781] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3fa4090 | out: hHeap=0x5e0000) returned 1 [0061.781] CloseHandle (hObject=0x190) returned 1 [0062.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0062.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.001] lstrlenW (lpString=".doc") returned 4 [0062.001] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.001] lstrlenW (lpString=".docx") returned 5 [0062.001] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0062.001] lstrlenW (lpString=".pdf") returned 4 [0062.001] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.001] lstrlenW (lpString=".xls") returned 4 [0062.001] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.001] lstrlenW (lpString=".xlsx") returned 5 [0062.002] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0062.002] lstrlenW (lpString=".ppt") returned 4 [0062.002] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.002] lstrlenW (lpString=".zip") returned 4 [0062.002] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.002] lstrlenW (lpString=".rar") returned 4 [0062.002] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.002] lstrlenW (lpString=".bz2") returned 4 [0062.002] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.002] lstrlenW (lpString=".7z") returned 3 [0062.002] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.002] lstrlenW (lpString=".dbf") returned 4 [0062.002] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.002] lstrlenW (lpString=".1cd") returned 4 [0062.002] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.002] lstrlenW (lpString=".jpg") returned 4 [0062.002] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.002] lstrlenW (lpString=".doc") returned 4 [0062.002] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.002] lstrlenW (lpString=".docx") returned 5 [0062.002] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0062.002] lstrlenW (lpString=".pdf") returned 4 [0062.003] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.003] lstrlenW (lpString=".xls") returned 4 [0062.003] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.003] lstrlenW (lpString=".xlsx") returned 5 [0062.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0062.003] lstrlenW (lpString=".ppt") returned 4 [0062.003] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.003] lstrlenW (lpString=".zip") returned 4 [0062.003] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.003] lstrlenW (lpString=".rar") returned 4 [0062.003] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.003] lstrlenW (lpString=".bz2") returned 4 [0062.003] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.003] lstrlenW (lpString=".7z") returned 3 [0062.003] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.003] lstrlenW (lpString=".dbf") returned 4 [0062.003] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.003] lstrlenW (lpString=".1cd") returned 4 [0062.003] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0062.003] lstrlenW (lpString=".jpg") returned 4 [0062.003] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.004] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0062.004] lstrlenW (lpString="SETUP.XML") returned 9 [0062.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0067.450] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1452) returned 1 [0067.459] CloseHandle (hObject=0x1a4) returned 1 [0067.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0067.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0067.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0067.460] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.460] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0067.460] GetLastError () returned 0x0 [0067.460] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0067.659] WriteFile (in: hFile=0x1b4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0067.660] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.660] WriteFile (in: hFile=0x1b4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0067.660] SetEndOfFile (hFile=0x1b4) returned 1 [0067.660] CloseHandle (hObject=0x1b4) returned 1 [0067.660] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.660] SetEndOfFile (hFile=0x1a4) returned 1 [0067.661] CloseHandle (hObject=0x1a4) returned 1 [0067.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0067.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0067.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.662] lstrlenW (lpString=".doc") returned 4 [0067.662] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.662] lstrlenW (lpString=".docx") returned 5 [0067.662] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0067.662] lstrlenW (lpString=".pdf") returned 4 [0067.662] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.662] lstrlenW (lpString=".xls") returned 4 [0067.662] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.662] lstrlenW (lpString=".xlsx") returned 5 [0067.662] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0067.662] lstrlenW (lpString=".ppt") returned 4 [0067.662] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.662] lstrlenW (lpString=".zip") returned 4 [0067.662] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.662] lstrlenW (lpString=".rar") returned 4 [0067.662] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.662] lstrlenW (lpString=".bz2") returned 4 [0067.662] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.662] lstrlenW (lpString=".7z") returned 3 [0067.662] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.662] lstrlenW (lpString=".dbf") returned 4 [0067.662] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.663] lstrlenW (lpString=".1cd") returned 4 [0067.663] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.663] lstrlenW (lpString=".jpg") returned 4 [0067.663] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.663] lstrlenW (lpString=".doc") returned 4 [0067.663] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString=".docx") returned 5 [0067.663] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0067.663] lstrlenW (lpString=".pdf") returned 4 [0067.663] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString=".xls") returned 4 [0067.663] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString=".xlsx") returned 5 [0067.663] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0067.663] lstrlenW (lpString=".ppt") returned 4 [0067.663] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.663] lstrlenW (lpString=".zip") returned 4 [0067.663] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.663] lstrlenW (lpString=".rar") returned 4 [0067.663] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString=".bz2") returned 4 [0067.663] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString=".7z") returned 3 [0067.663] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.663] lstrlenW (lpString=".dbf") returned 4 [0067.663] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.663] lstrlenW (lpString=".1cd") returned 4 [0067.663] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0067.663] lstrlenW (lpString=".jpg") returned 4 [0067.663] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.664] lstrcmpiW (lpString1=".CHM", lpString2=".beets") returned 1 [0067.664] lstrlenW (lpString="OCT.CHM") returned 7 [0067.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0067.837] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=71236) returned 1 [0067.837] CloseHandle (hObject=0x1c4) returned 1 [0067.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0067.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0067.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0067.837] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.837] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0067.837] GetLastError () returned 0x0 [0067.837] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x11644, lpOverlapped=0x0) returned 1 [0068.045] WriteFile (in: hFile=0x1cc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0068.046] ReadFile (in: hFile=0x1c4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.046] WriteFile (in: hFile=0x1cc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0068.046] SetEndOfFile (hFile=0x1cc) returned 1 [0068.046] CloseHandle (hObject=0x1cc) returned 1 [0068.047] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.047] SetEndOfFile (hFile=0x1c4) returned 1 [0068.048] CloseHandle (hObject=0x1c4) returned 1 [0068.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0068.048] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0068.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.048] lstrlenW (lpString=".doc") returned 4 [0068.048] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0068.048] lstrlenW (lpString=".docx") returned 5 [0068.048] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0068.048] lstrlenW (lpString=".pdf") returned 4 [0068.048] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0068.048] lstrlenW (lpString=".xls") returned 4 [0068.048] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0068.048] lstrlenW (lpString=".xlsx") returned 5 [0068.048] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0068.048] lstrlenW (lpString=".ppt") returned 4 [0068.048] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0068.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.048] lstrlenW (lpString=".zip") returned 4 [0068.049] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString=".rar") returned 4 [0068.049] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString=".bz2") returned 4 [0068.049] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0068.049] lstrlenW (lpString=".7z") returned 3 [0068.049] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0068.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.049] lstrlenW (lpString=".dbf") returned 4 [0068.049] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.049] lstrlenW (lpString=".1cd") returned 4 [0068.049] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0068.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.049] lstrlenW (lpString=".jpg") returned 4 [0068.049] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.049] lstrlenW (lpString=".doc") returned 4 [0068.049] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString=".docx") returned 5 [0068.049] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0068.049] lstrlenW (lpString=".pdf") returned 4 [0068.049] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString=".xls") returned 4 [0068.049] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString=".xlsx") returned 5 [0068.049] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0068.049] lstrlenW (lpString=".ppt") returned 4 [0068.049] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.049] lstrlenW (lpString=".zip") returned 4 [0068.049] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString=".rar") returned 4 [0068.049] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0068.049] lstrlenW (lpString=".bz2") returned 4 [0068.049] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0068.049] lstrlenW (lpString=".7z") returned 3 [0068.050] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0068.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.050] lstrlenW (lpString=".dbf") returned 4 [0068.050] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0068.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.050] lstrlenW (lpString=".1cd") returned 4 [0068.050] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0068.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0068.050] lstrlenW (lpString=".jpg") returned 4 [0068.050] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0068.050] lstrcmpiW (lpString1=".CHM", lpString2=".beets") returned 1 [0068.050] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0068.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0068.294] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=37689) returned 1 [0068.294] CloseHandle (hObject=0x1a4) returned 1 [0068.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0068.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0068.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0068.294] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.295] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0068.295] GetLastError () returned 0x0 [0068.295] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x9339, lpOverlapped=0x0) returned 1 [0068.917] WriteFile (in: hFile=0x1c4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0068.918] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.919] WriteFile (in: hFile=0x1c4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.919] SetEndOfFile (hFile=0x1c4) returned 1 [0068.919] CloseHandle (hObject=0x1c4) returned 1 [0068.920] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.920] SetEndOfFile (hFile=0x1a4) returned 1 [0068.921] CloseHandle (hObject=0x1a4) returned 1 [0068.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0068.921] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0068.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.922] lstrlenW (lpString=".doc") returned 4 [0068.922] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0068.922] lstrlenW (lpString=".docx") returned 5 [0068.922] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0068.922] lstrlenW (lpString=".pdf") returned 4 [0068.922] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0068.922] lstrlenW (lpString=".xls") returned 4 [0068.922] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0068.922] lstrlenW (lpString=".xlsx") returned 5 [0068.922] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0068.922] lstrlenW (lpString=".ppt") returned 4 [0068.922] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0068.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.922] lstrlenW (lpString=".zip") returned 4 [0068.922] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0068.922] lstrlenW (lpString=".rar") returned 4 [0068.922] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0068.922] lstrlenW (lpString=".bz2") returned 4 [0068.922] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0068.922] lstrlenW (lpString=".7z") returned 3 [0068.922] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0068.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.922] lstrlenW (lpString=".dbf") returned 4 [0068.922] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0068.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.923] lstrlenW (lpString=".1cd") returned 4 [0068.923] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0068.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.923] lstrlenW (lpString=".jpg") returned 4 [0068.923] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0068.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.923] lstrlenW (lpString=".doc") returned 4 [0068.923] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0068.923] lstrlenW (lpString=".docx") returned 5 [0068.923] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0068.923] lstrlenW (lpString=".pdf") returned 4 [0068.923] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0068.923] lstrlenW (lpString=".xls") returned 4 [0068.923] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0068.923] lstrlenW (lpString=".xlsx") returned 5 [0068.923] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0068.923] lstrlenW (lpString=".ppt") returned 4 [0068.923] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0068.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.923] lstrlenW (lpString=".zip") returned 4 [0068.923] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0068.923] lstrlenW (lpString=".rar") returned 4 [0068.923] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0068.923] lstrlenW (lpString=".bz2") returned 4 [0068.923] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0068.924] lstrlenW (lpString=".7z") returned 3 [0068.924] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0068.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.924] lstrlenW (lpString=".dbf") returned 4 [0068.924] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0068.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.924] lstrlenW (lpString=".1cd") returned 4 [0068.924] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0068.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0068.924] lstrlenW (lpString=".jpg") returned 4 [0068.924] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0068.924] lstrcmpiW (lpString1=".CHM", lpString2=".beets") returned 1 [0068.924] lstrlenW (lpString="SETUP.CHM") returned 9 [0068.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0069.728] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=67190) returned 1 [0069.728] CloseHandle (hObject=0x184) returned 1 [0069.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0069.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0069.728] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.729] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0069.729] GetLastError () returned 0x0 [0069.729] ReadFile (in: hFile=0x184, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x10676, lpOverlapped=0x0) returned 1 [0069.784] WriteFile (in: hFile=0x1a4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0069.785] ReadFile (in: hFile=0x184, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.785] WriteFile (in: hFile=0x1a4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.785] SetEndOfFile (hFile=0x1a4) returned 1 [0069.785] CloseHandle (hObject=0x1a4) returned 1 [0069.786] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.786] SetEndOfFile (hFile=0x184) returned 1 [0069.787] CloseHandle (hObject=0x184) returned 1 [0069.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0069.787] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0069.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.787] lstrlenW (lpString=".doc") returned 4 [0069.787] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.787] lstrlenW (lpString=".docx") returned 5 [0069.787] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0069.787] lstrlenW (lpString=".pdf") returned 4 [0069.787] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.787] lstrlenW (lpString=".xls") returned 4 [0069.788] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.788] lstrlenW (lpString=".xlsx") returned 5 [0069.788] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0069.788] lstrlenW (lpString=".ppt") returned 4 [0069.788] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.788] lstrlenW (lpString=".zip") returned 4 [0069.788] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.788] lstrlenW (lpString=".rar") returned 4 [0069.788] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.788] lstrlenW (lpString=".bz2") returned 4 [0069.788] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.788] lstrlenW (lpString=".7z") returned 3 [0069.788] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.788] lstrlenW (lpString=".dbf") returned 4 [0069.788] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.788] lstrlenW (lpString=".1cd") returned 4 [0069.788] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.788] lstrlenW (lpString=".jpg") returned 4 [0069.788] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.788] lstrlenW (lpString=".doc") returned 4 [0069.788] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.788] lstrlenW (lpString=".docx") returned 5 [0069.788] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0069.788] lstrlenW (lpString=".pdf") returned 4 [0069.788] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.788] lstrlenW (lpString=".xls") returned 4 [0069.789] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.789] lstrlenW (lpString=".xlsx") returned 5 [0069.789] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0069.789] lstrlenW (lpString=".ppt") returned 4 [0069.789] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.789] lstrlenW (lpString=".zip") returned 4 [0069.789] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.789] lstrlenW (lpString=".rar") returned 4 [0069.789] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.789] lstrlenW (lpString=".bz2") returned 4 [0069.789] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.789] lstrlenW (lpString=".7z") returned 3 [0069.789] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.789] lstrlenW (lpString=".dbf") returned 4 [0069.789] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.789] lstrlenW (lpString=".1cd") returned 4 [0069.789] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0069.789] lstrlenW (lpString=".jpg") returned 4 [0069.789] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.789] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.789] lstrlenW (lpString="SETUP.XML") returned 9 [0069.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.856] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2362) returned 1 [0069.856] CloseHandle (hObject=0x20c) returned 1 [0069.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0069.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.856] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.856] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0069.857] GetLastError () returned 0x0 [0069.857] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x93a, lpOverlapped=0x0) returned 1 [0069.884] WriteFile (in: hFile=0x190, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x940, lpOverlapped=0x0) returned 1 [0069.884] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.884] WriteFile (in: hFile=0x190, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.884] SetEndOfFile (hFile=0x190) returned 1 [0069.884] CloseHandle (hObject=0x190) returned 1 [0069.885] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.885] SetEndOfFile (hFile=0x20c) returned 1 [0069.886] CloseHandle (hObject=0x20c) returned 1 [0069.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0069.886] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0069.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.887] lstrlenW (lpString=".doc") returned 4 [0069.887] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.887] lstrlenW (lpString=".docx") returned 5 [0069.887] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0069.887] lstrlenW (lpString=".pdf") returned 4 [0069.887] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.887] lstrlenW (lpString=".xls") returned 4 [0069.887] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.887] lstrlenW (lpString=".xlsx") returned 5 [0069.887] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0069.887] lstrlenW (lpString=".ppt") returned 4 [0069.887] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.887] lstrlenW (lpString=".zip") returned 4 [0069.887] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.887] lstrlenW (lpString=".rar") returned 4 [0069.887] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.887] lstrlenW (lpString=".bz2") returned 4 [0069.887] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.887] lstrlenW (lpString=".7z") returned 3 [0069.887] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.887] lstrlenW (lpString=".dbf") returned 4 [0069.887] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.887] lstrlenW (lpString=".1cd") returned 4 [0069.887] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.888] lstrlenW (lpString=".jpg") returned 4 [0069.888] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.888] lstrlenW (lpString=".doc") returned 4 [0069.888] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.888] lstrlenW (lpString=".docx") returned 5 [0069.888] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0069.888] lstrlenW (lpString=".pdf") returned 4 [0069.888] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.888] lstrlenW (lpString=".xls") returned 4 [0069.888] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.888] lstrlenW (lpString=".xlsx") returned 5 [0069.888] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0069.888] lstrlenW (lpString=".ppt") returned 4 [0069.888] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.888] lstrlenW (lpString=".zip") returned 4 [0069.888] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.888] lstrlenW (lpString=".rar") returned 4 [0069.888] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.888] lstrlenW (lpString=".bz2") returned 4 [0069.888] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.888] lstrlenW (lpString=".7z") returned 3 [0069.888] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.888] lstrlenW (lpString=".dbf") returned 4 [0069.888] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.889] lstrlenW (lpString=".1cd") returned 4 [0069.889] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0069.889] lstrlenW (lpString=".jpg") returned 4 [0069.889] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.889] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.889] lstrlenW (lpString="SETUP.XML") returned 9 [0069.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.189] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1988) returned 1 [0070.189] CloseHandle (hObject=0x210) returned 1 [0070.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0070.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.189] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.189] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0070.190] GetLastError () returned 0x0 [0070.190] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0070.382] WriteFile (in: hFile=0x1b4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0070.383] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.383] WriteFile (in: hFile=0x1b4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.383] SetEndOfFile (hFile=0x1b4) returned 1 [0070.383] CloseHandle (hObject=0x1b4) returned 1 [0070.384] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.385] SetEndOfFile (hFile=0x210) returned 1 [0070.385] CloseHandle (hObject=0x210) returned 1 [0070.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.386] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0070.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.386] lstrlenW (lpString=".doc") returned 4 [0070.386] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.386] lstrlenW (lpString=".docx") returned 5 [0070.386] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.386] lstrlenW (lpString=".pdf") returned 4 [0070.386] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.386] lstrlenW (lpString=".xls") returned 4 [0070.386] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.386] lstrlenW (lpString=".xlsx") returned 5 [0070.387] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.387] lstrlenW (lpString=".ppt") returned 4 [0070.387] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.387] lstrlenW (lpString=".zip") returned 4 [0070.387] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.387] lstrlenW (lpString=".rar") returned 4 [0070.387] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.387] lstrlenW (lpString=".bz2") returned 4 [0070.387] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.387] lstrlenW (lpString=".7z") returned 3 [0070.387] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.387] lstrlenW (lpString=".dbf") returned 4 [0070.387] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.387] lstrlenW (lpString=".1cd") returned 4 [0070.387] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.387] lstrlenW (lpString=".jpg") returned 4 [0070.387] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.387] lstrlenW (lpString=".doc") returned 4 [0070.387] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.387] lstrlenW (lpString=".docx") returned 5 [0070.387] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.387] lstrlenW (lpString=".pdf") returned 4 [0070.387] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.388] lstrlenW (lpString=".xls") returned 4 [0070.388] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.388] lstrlenW (lpString=".xlsx") returned 5 [0070.388] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.388] lstrlenW (lpString=".ppt") returned 4 [0070.388] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.388] lstrlenW (lpString=".zip") returned 4 [0070.388] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.388] lstrlenW (lpString=".rar") returned 4 [0070.388] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.388] lstrlenW (lpString=".bz2") returned 4 [0070.388] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.388] lstrlenW (lpString=".7z") returned 3 [0070.388] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.388] lstrlenW (lpString=".dbf") returned 4 [0070.388] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.388] lstrlenW (lpString=".1cd") returned 4 [0070.388] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0070.388] lstrlenW (lpString=".jpg") returned 4 [0070.388] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.388] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.389] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0070.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.389] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1452) returned 1 [0070.389] CloseHandle (hObject=0x210) returned 1 [0070.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0070.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.389] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.389] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0070.530] GetLastError () returned 0x0 [0070.530] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0070.613] WriteFile (in: hFile=0x20c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0070.727] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.728] WriteFile (in: hFile=0x20c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0070.728] SetEndOfFile (hFile=0x20c) returned 1 [0070.728] CloseHandle (hObject=0x20c) returned 1 [0070.728] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.728] SetEndOfFile (hFile=0x210) returned 1 [0070.729] CloseHandle (hObject=0x210) returned 1 [0070.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.729] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0070.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.729] lstrlenW (lpString=".doc") returned 4 [0070.729] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.729] lstrlenW (lpString=".docx") returned 5 [0070.729] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.729] lstrlenW (lpString=".pdf") returned 4 [0070.729] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.729] lstrlenW (lpString=".xls") returned 4 [0070.729] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.729] lstrlenW (lpString=".xlsx") returned 5 [0070.729] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.729] lstrlenW (lpString=".ppt") returned 4 [0070.729] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.729] lstrlenW (lpString=".zip") returned 4 [0070.730] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.730] lstrlenW (lpString=".rar") returned 4 [0070.730] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString=".bz2") returned 4 [0070.730] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString=".7z") returned 3 [0070.730] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.730] lstrlenW (lpString=".dbf") returned 4 [0070.730] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.730] lstrlenW (lpString=".1cd") returned 4 [0070.730] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.730] lstrlenW (lpString=".jpg") returned 4 [0070.730] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.730] lstrlenW (lpString=".doc") returned 4 [0070.730] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString=".docx") returned 5 [0070.730] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.730] lstrlenW (lpString=".pdf") returned 4 [0070.730] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString=".xls") returned 4 [0070.730] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString=".xlsx") returned 5 [0070.730] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.730] lstrlenW (lpString=".ppt") returned 4 [0070.730] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.731] lstrlenW (lpString=".zip") returned 4 [0070.731] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.731] lstrlenW (lpString=".rar") returned 4 [0070.731] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.731] lstrlenW (lpString=".bz2") returned 4 [0070.731] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.731] lstrlenW (lpString=".7z") returned 3 [0070.731] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.731] lstrlenW (lpString=".dbf") returned 4 [0070.731] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.731] lstrlenW (lpString=".1cd") returned 4 [0070.731] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0070.731] lstrlenW (lpString=".jpg") returned 4 [0070.731] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.731] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.731] lstrlenW (lpString="Proof.XML") returned 9 [0070.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.732] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1347) returned 1 [0070.732] CloseHandle (hObject=0x210) returned 1 [0070.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0070.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.732] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.732] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0070.733] GetLastError () returned 0x0 [0070.733] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x543, lpOverlapped=0x0) returned 1 [0070.915] WriteFile (in: hFile=0x20c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x550, lpOverlapped=0x0) returned 1 [0070.916] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.916] WriteFile (in: hFile=0x20c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.916] SetEndOfFile (hFile=0x20c) returned 1 [0070.917] CloseHandle (hObject=0x20c) returned 1 [0070.917] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.917] SetEndOfFile (hFile=0x210) returned 1 [0070.918] CloseHandle (hObject=0x210) returned 1 [0070.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.918] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0070.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.919] lstrlenW (lpString=".doc") returned 4 [0070.919] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.919] lstrlenW (lpString=".docx") returned 5 [0070.919] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0070.919] lstrlenW (lpString=".pdf") returned 4 [0070.919] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.919] lstrlenW (lpString=".xls") returned 4 [0070.919] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.919] lstrlenW (lpString=".xlsx") returned 5 [0070.919] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0070.919] lstrlenW (lpString=".ppt") returned 4 [0070.919] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.919] lstrlenW (lpString=".zip") returned 4 [0070.919] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.919] lstrlenW (lpString=".rar") returned 4 [0070.919] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.919] lstrlenW (lpString=".bz2") returned 4 [0070.919] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString=".7z") returned 3 [0070.920] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.920] lstrlenW (lpString=".dbf") returned 4 [0070.920] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.920] lstrlenW (lpString=".1cd") returned 4 [0070.920] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.920] lstrlenW (lpString=".jpg") returned 4 [0070.920] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.920] lstrlenW (lpString=".doc") returned 4 [0070.920] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString=".docx") returned 5 [0070.920] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0070.920] lstrlenW (lpString=".pdf") returned 4 [0070.920] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString=".xls") returned 4 [0070.920] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString=".xlsx") returned 5 [0070.920] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0070.920] lstrlenW (lpString=".ppt") returned 4 [0070.920] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.920] lstrlenW (lpString=".zip") returned 4 [0070.920] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.920] lstrlenW (lpString=".rar") returned 4 [0070.920] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString=".bz2") returned 4 [0070.920] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.920] lstrlenW (lpString=".7z") returned 3 [0070.921] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.921] lstrlenW (lpString=".dbf") returned 4 [0070.921] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.921] lstrlenW (lpString=".1cd") returned 4 [0070.921] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0070.921] lstrlenW (lpString=".jpg") returned 4 [0070.921] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.921] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.921] lstrlenW (lpString="Proof.XML") returned 9 [0070.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.921] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1458) returned 1 [0070.922] CloseHandle (hObject=0x210) returned 1 [0070.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0070.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.922] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.922] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0070.922] GetLastError () returned 0x0 [0070.922] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0070.993] WriteFile (in: hFile=0x20c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0070.993] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.994] WriteFile (in: hFile=0x20c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.994] SetEndOfFile (hFile=0x20c) returned 1 [0070.994] CloseHandle (hObject=0x20c) returned 1 [0070.994] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.994] SetEndOfFile (hFile=0x210) returned 1 [0070.995] CloseHandle (hObject=0x210) returned 1 [0070.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.995] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0070.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.995] lstrlenW (lpString=".doc") returned 4 [0070.995] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.995] lstrlenW (lpString=".docx") returned 5 [0070.995] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0070.995] lstrlenW (lpString=".pdf") returned 4 [0070.995] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.995] lstrlenW (lpString=".xls") returned 4 [0070.995] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.995] lstrlenW (lpString=".xlsx") returned 5 [0070.995] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0070.995] lstrlenW (lpString=".ppt") returned 4 [0070.996] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.996] lstrlenW (lpString=".zip") returned 4 [0070.996] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.996] lstrlenW (lpString=".rar") returned 4 [0070.996] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString=".bz2") returned 4 [0070.996] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString=".7z") returned 3 [0070.996] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.996] lstrlenW (lpString=".dbf") returned 4 [0070.996] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.996] lstrlenW (lpString=".1cd") returned 4 [0070.996] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.996] lstrlenW (lpString=".jpg") returned 4 [0070.996] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.996] lstrlenW (lpString=".doc") returned 4 [0070.996] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString=".docx") returned 5 [0070.996] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0070.996] lstrlenW (lpString=".pdf") returned 4 [0070.996] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString=".xls") returned 4 [0070.996] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.996] lstrlenW (lpString=".xlsx") returned 5 [0070.996] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0070.996] lstrlenW (lpString=".ppt") returned 4 [0070.997] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.997] lstrlenW (lpString=".zip") returned 4 [0070.997] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.997] lstrlenW (lpString=".rar") returned 4 [0070.997] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.997] lstrlenW (lpString=".bz2") returned 4 [0070.997] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.997] lstrlenW (lpString=".7z") returned 3 [0070.997] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.997] lstrlenW (lpString=".dbf") returned 4 [0070.997] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.997] lstrlenW (lpString=".1cd") returned 4 [0070.997] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0070.997] lstrlenW (lpString=".jpg") returned 4 [0070.997] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.997] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.997] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0070.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.003] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=16852) returned 1 [0071.003] CloseHandle (hObject=0x19c) returned 1 [0071.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0071.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.003] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.003] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.004] GetLastError () returned 0x0 [0071.004] ReadFile (in: hFile=0x19c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0071.117] WriteFile (in: hFile=0x210, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0071.119] ReadFile (in: hFile=0x19c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.120] WriteFile (in: hFile=0x210, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0071.120] SetEndOfFile (hFile=0x210) returned 1 [0071.120] CloseHandle (hObject=0x210) returned 1 [0071.120] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.120] SetEndOfFile (hFile=0x19c) returned 1 [0071.121] CloseHandle (hObject=0x19c) returned 1 [0071.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.121] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0071.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.121] lstrlenW (lpString=".doc") returned 4 [0071.121] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.121] lstrlenW (lpString=".docx") returned 5 [0071.121] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0071.121] lstrlenW (lpString=".pdf") returned 4 [0071.121] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.121] lstrlenW (lpString=".xls") returned 4 [0071.121] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.121] lstrlenW (lpString=".xlsx") returned 5 [0071.121] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0071.121] lstrlenW (lpString=".ppt") returned 4 [0071.121] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.121] lstrlenW (lpString=".zip") returned 4 [0071.121] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.122] lstrlenW (lpString=".rar") returned 4 [0071.122] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString=".bz2") returned 4 [0071.122] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString=".7z") returned 3 [0071.122] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.122] lstrlenW (lpString=".dbf") returned 4 [0071.122] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.122] lstrlenW (lpString=".1cd") returned 4 [0071.122] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.122] lstrlenW (lpString=".jpg") returned 4 [0071.122] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.122] lstrlenW (lpString=".doc") returned 4 [0071.122] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString=".docx") returned 5 [0071.122] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0071.122] lstrlenW (lpString=".pdf") returned 4 [0071.122] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString=".xls") returned 4 [0071.122] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString=".xlsx") returned 5 [0071.122] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0071.122] lstrlenW (lpString=".ppt") returned 4 [0071.122] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.122] lstrlenW (lpString=".zip") returned 4 [0071.122] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.122] lstrlenW (lpString=".rar") returned 4 [0071.122] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString=".bz2") returned 4 [0071.122] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.122] lstrlenW (lpString=".7z") returned 3 [0071.122] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.122] lstrlenW (lpString=".dbf") returned 4 [0071.123] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.123] lstrlenW (lpString=".1cd") returned 4 [0071.123] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0071.123] lstrlenW (lpString=".jpg") returned 4 [0071.123] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.123] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.123] lstrlenW (lpString="SETUP.XML") returned 9 [0071.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.123] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=31094) returned 1 [0071.123] CloseHandle (hObject=0x19c) returned 1 [0071.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0071.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.123] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.124] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.129] GetLastError () returned 0x0 [0071.129] ReadFile (in: hFile=0x19c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x7976, lpOverlapped=0x0) returned 1 [0071.131] WriteFile (in: hFile=0x210, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0071.132] ReadFile (in: hFile=0x19c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.132] WriteFile (in: hFile=0x210, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.132] SetEndOfFile (hFile=0x210) returned 1 [0071.133] CloseHandle (hObject=0x210) returned 1 [0071.133] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.133] SetEndOfFile (hFile=0x19c) returned 1 [0071.133] CloseHandle (hObject=0x19c) returned 1 [0071.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.134] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0071.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.134] lstrlenW (lpString=".doc") returned 4 [0071.134] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.134] lstrlenW (lpString=".docx") returned 5 [0071.134] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.134] lstrlenW (lpString=".pdf") returned 4 [0071.134] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.134] lstrlenW (lpString=".xls") returned 4 [0071.134] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.134] lstrlenW (lpString=".xlsx") returned 5 [0071.134] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.134] lstrlenW (lpString=".ppt") returned 4 [0071.134] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.134] lstrlenW (lpString=".zip") returned 4 [0071.134] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.134] lstrlenW (lpString=".rar") returned 4 [0071.134] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.134] lstrlenW (lpString=".bz2") returned 4 [0071.134] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.134] lstrlenW (lpString=".7z") returned 3 [0071.134] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.135] lstrlenW (lpString=".dbf") returned 4 [0071.135] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.135] lstrlenW (lpString=".1cd") returned 4 [0071.135] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.135] lstrlenW (lpString=".jpg") returned 4 [0071.135] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.135] lstrlenW (lpString=".doc") returned 4 [0071.135] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString=".docx") returned 5 [0071.135] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.135] lstrlenW (lpString=".pdf") returned 4 [0071.135] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString=".xls") returned 4 [0071.135] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString=".xlsx") returned 5 [0071.135] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.135] lstrlenW (lpString=".ppt") returned 4 [0071.135] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.135] lstrlenW (lpString=".zip") returned 4 [0071.135] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.135] lstrlenW (lpString=".rar") returned 4 [0071.135] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString=".bz2") returned 4 [0071.135] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString=".7z") returned 3 [0071.135] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.135] lstrlenW (lpString=".dbf") returned 4 [0071.135] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.135] lstrlenW (lpString=".1cd") returned 4 [0071.135] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0071.136] lstrlenW (lpString=".jpg") returned 4 [0071.136] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.136] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.136] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0071.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.136] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1450) returned 1 [0071.136] CloseHandle (hObject=0x19c) returned 1 [0071.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0071.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.136] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.136] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.138] GetLastError () returned 0x0 [0071.138] ReadFile (in: hFile=0x19c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0071.222] WriteFile (in: hFile=0x210, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0071.258] ReadFile (in: hFile=0x19c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.258] WriteFile (in: hFile=0x210, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0071.258] SetEndOfFile (hFile=0x210) returned 1 [0071.259] CloseHandle (hObject=0x210) returned 1 [0071.259] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.259] SetEndOfFile (hFile=0x19c) returned 1 [0071.259] CloseHandle (hObject=0x19c) returned 1 [0071.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.260] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0071.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.260] lstrlenW (lpString=".doc") returned 4 [0071.260] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.260] lstrlenW (lpString=".docx") returned 5 [0071.260] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.260] lstrlenW (lpString=".pdf") returned 4 [0071.260] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.260] lstrlenW (lpString=".xls") returned 4 [0071.260] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.260] lstrlenW (lpString=".xlsx") returned 5 [0071.260] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.260] lstrlenW (lpString=".ppt") returned 4 [0071.260] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.260] lstrlenW (lpString=".zip") returned 4 [0071.260] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.260] lstrlenW (lpString=".rar") returned 4 [0071.260] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.260] lstrlenW (lpString=".bz2") returned 4 [0071.260] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.260] lstrlenW (lpString=".7z") returned 3 [0071.260] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.260] lstrlenW (lpString=".dbf") returned 4 [0071.260] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.261] lstrlenW (lpString=".1cd") returned 4 [0071.261] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.261] lstrlenW (lpString=".jpg") returned 4 [0071.261] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.261] lstrlenW (lpString=".doc") returned 4 [0071.261] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString=".docx") returned 5 [0071.261] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.261] lstrlenW (lpString=".pdf") returned 4 [0071.261] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString=".xls") returned 4 [0071.261] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString=".xlsx") returned 5 [0071.261] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.261] lstrlenW (lpString=".ppt") returned 4 [0071.261] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.261] lstrlenW (lpString=".zip") returned 4 [0071.261] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.261] lstrlenW (lpString=".rar") returned 4 [0071.261] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString=".bz2") returned 4 [0071.261] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString=".7z") returned 3 [0071.261] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.261] lstrlenW (lpString=".dbf") returned 4 [0071.261] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.261] lstrlenW (lpString=".1cd") returned 4 [0071.261] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0071.261] lstrlenW (lpString=".jpg") returned 4 [0071.261] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.262] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.262] lstrlenW (lpString="VisioMUI.XML") returned 12 [0071.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.359] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=9503) returned 1 [0071.359] CloseHandle (hObject=0x210) returned 1 [0071.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0071.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.360] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.360] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.364] GetLastError () returned 0x0 [0071.364] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x251f, lpOverlapped=0x0) returned 1 [0071.626] WriteFile (in: hFile=0x1cc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0071.627] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.627] WriteFile (in: hFile=0x1cc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.627] SetEndOfFile (hFile=0x1cc) returned 1 [0071.627] CloseHandle (hObject=0x1cc) returned 1 [0071.627] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.627] SetEndOfFile (hFile=0x210) returned 1 [0071.628] CloseHandle (hObject=0x210) returned 1 [0071.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.628] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0071.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.629] lstrlenW (lpString=".doc") returned 4 [0071.629] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.629] lstrlenW (lpString=".docx") returned 5 [0071.629] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.629] lstrlenW (lpString=".pdf") returned 4 [0071.629] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.629] lstrlenW (lpString=".xls") returned 4 [0071.629] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.629] lstrlenW (lpString=".xlsx") returned 5 [0071.629] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.629] lstrlenW (lpString=".ppt") returned 4 [0071.629] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.629] lstrlenW (lpString=".zip") returned 4 [0071.629] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.629] lstrlenW (lpString=".rar") returned 4 [0071.629] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.629] lstrlenW (lpString=".bz2") returned 4 [0071.629] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.629] lstrlenW (lpString=".7z") returned 3 [0071.629] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.629] lstrlenW (lpString=".dbf") returned 4 [0071.629] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.630] lstrlenW (lpString=".1cd") returned 4 [0071.630] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.630] lstrlenW (lpString=".jpg") returned 4 [0071.630] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.630] lstrlenW (lpString=".doc") returned 4 [0071.630] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.630] lstrlenW (lpString=".docx") returned 5 [0071.630] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0071.630] lstrlenW (lpString=".pdf") returned 4 [0071.630] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.630] lstrlenW (lpString=".xls") returned 4 [0071.630] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.630] lstrlenW (lpString=".xlsx") returned 5 [0071.630] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0071.630] lstrlenW (lpString=".ppt") returned 4 [0071.630] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.630] lstrlenW (lpString=".zip") returned 4 [0071.630] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.630] lstrlenW (lpString=".rar") returned 4 [0071.630] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.630] lstrlenW (lpString=".bz2") returned 4 [0071.630] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.630] lstrlenW (lpString=".7z") returned 3 [0071.630] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.631] lstrlenW (lpString=".dbf") returned 4 [0071.631] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.631] lstrlenW (lpString=".1cd") returned 4 [0071.631] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0071.631] lstrlenW (lpString=".jpg") returned 4 [0071.631] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.631] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.631] lstrlenW (lpString="DATES.XML") returned 9 [0071.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.631] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=8918) returned 1 [0071.632] CloseHandle (hObject=0x210) returned 1 [0071.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0071.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.632] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.632] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.653] GetLastError () returned 0x0 [0071.653] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0071.831] WriteFile (in: hFile=0x1a4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0071.832] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.832] WriteFile (in: hFile=0x1a4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.832] SetEndOfFile (hFile=0x1a4) returned 1 [0071.832] CloseHandle (hObject=0x1a4) returned 1 [0071.832] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.832] SetEndOfFile (hFile=0x210) returned 1 [0071.833] CloseHandle (hObject=0x210) returned 1 [0071.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.834] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0072.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.177] lstrlenW (lpString=".doc") returned 4 [0072.177] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString=".docx") returned 5 [0072.177] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0072.177] lstrlenW (lpString=".pdf") returned 4 [0072.177] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString=".xls") returned 4 [0072.177] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString=".xlsx") returned 5 [0072.177] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0072.177] lstrlenW (lpString=".ppt") returned 4 [0072.177] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.177] lstrlenW (lpString=".zip") returned 4 [0072.177] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0072.177] lstrlenW (lpString=".rar") returned 4 [0072.177] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString=".bz2") returned 4 [0072.177] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString=".7z") returned 3 [0072.177] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0072.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.177] lstrlenW (lpString=".dbf") returned 4 [0072.177] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.177] lstrlenW (lpString=".1cd") returned 4 [0072.177] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.177] lstrlenW (lpString=".jpg") returned 4 [0072.177] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0072.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.177] lstrlenW (lpString=".doc") returned 4 [0072.177] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0072.178] lstrlenW (lpString=".docx") returned 5 [0072.178] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0072.178] lstrlenW (lpString=".pdf") returned 4 [0072.178] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0072.178] lstrlenW (lpString=".xls") returned 4 [0072.178] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0072.178] lstrlenW (lpString=".xlsx") returned 5 [0072.178] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0072.178] lstrlenW (lpString=".ppt") returned 4 [0072.178] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0072.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.178] lstrlenW (lpString=".zip") returned 4 [0072.178] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0072.178] lstrlenW (lpString=".rar") returned 4 [0072.178] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0072.178] lstrlenW (lpString=".bz2") returned 4 [0072.178] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0072.178] lstrlenW (lpString=".7z") returned 3 [0072.178] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0072.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.178] lstrlenW (lpString=".dbf") returned 4 [0072.178] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0072.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.178] lstrlenW (lpString=".1cd") returned 4 [0072.178] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0072.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0072.178] lstrlenW (lpString=".jpg") returned 4 [0072.178] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0072.178] lstrcmpiW (lpString1=".htm", lpString2=".beets") returned 1 [0072.178] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0072.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.205] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=237) returned 1 [0072.205] CloseHandle (hObject=0x190) returned 1 [0072.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0072.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.205] lstrlenW (lpString=".doc") returned 4 [0072.205] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0072.205] lstrlenW (lpString=".docx") returned 5 [0072.205] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0072.205] lstrlenW (lpString=".pdf") returned 4 [0072.205] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0072.205] lstrlenW (lpString=".xls") returned 4 [0072.205] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0072.205] lstrlenW (lpString=".xlsx") returned 5 [0072.205] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0072.205] lstrlenW (lpString=".ppt") returned 4 [0072.205] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0072.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.205] lstrlenW (lpString=".zip") returned 4 [0072.206] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0072.206] lstrlenW (lpString=".rar") returned 4 [0072.206] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0072.206] lstrlenW (lpString=".bz2") returned 4 [0072.206] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0072.206] lstrlenW (lpString=".7z") returned 3 [0072.206] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0072.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.206] lstrlenW (lpString=".dbf") returned 4 [0072.206] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0072.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.206] lstrlenW (lpString=".1cd") returned 4 [0072.206] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0072.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.206] lstrlenW (lpString=".jpg") returned 4 [0072.206] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0072.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.206] lstrlenW (lpString=".doc") returned 4 [0072.206] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0072.206] lstrlenW (lpString=".docx") returned 5 [0072.206] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0072.206] lstrlenW (lpString=".pdf") returned 4 [0072.206] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0072.206] lstrlenW (lpString=".xls") returned 4 [0072.206] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0072.206] lstrlenW (lpString=".xlsx") returned 5 [0072.206] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0072.206] lstrlenW (lpString=".ppt") returned 4 [0072.206] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0072.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.206] lstrlenW (lpString=".zip") returned 4 [0072.206] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0072.206] lstrlenW (lpString=".rar") returned 4 [0072.206] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0072.206] lstrlenW (lpString=".bz2") returned 4 [0072.206] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0072.206] lstrlenW (lpString=".7z") returned 3 [0072.207] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0072.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.207] lstrlenW (lpString=".dbf") returned 4 [0072.207] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0072.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.207] lstrlenW (lpString=".1cd") returned 4 [0072.207] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0072.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0072.207] lstrlenW (lpString=".jpg") returned 4 [0072.207] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0072.207] lstrcmpiW (lpString1=".wmf", lpString2=".beets") returned 1 [0072.207] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0072.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.207] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2920) returned 1 [0072.207] CloseHandle (hObject=0x190) returned 1 [0072.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0072.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.208] lstrlenW (lpString=".doc") returned 4 [0072.208] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString=".docx") returned 5 [0072.208] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0072.208] lstrlenW (lpString=".pdf") returned 4 [0072.208] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString=".xls") returned 4 [0072.208] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0072.208] lstrlenW (lpString=".xlsx") returned 5 [0072.208] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0072.208] lstrlenW (lpString=".ppt") returned 4 [0072.208] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.208] lstrlenW (lpString=".zip") returned 4 [0072.208] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0072.208] lstrlenW (lpString=".rar") returned 4 [0072.208] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString=".bz2") returned 4 [0072.208] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString=".7z") returned 3 [0072.208] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0072.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.208] lstrlenW (lpString=".dbf") returned 4 [0072.208] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.208] lstrlenW (lpString=".1cd") returned 4 [0072.208] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.208] lstrlenW (lpString=".jpg") returned 4 [0072.208] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.208] lstrlenW (lpString=".doc") returned 4 [0072.208] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0072.208] lstrlenW (lpString=".docx") returned 5 [0072.208] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0072.209] lstrlenW (lpString=".pdf") returned 4 [0072.209] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0072.209] lstrlenW (lpString=".xls") returned 4 [0072.209] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0072.209] lstrlenW (lpString=".xlsx") returned 5 [0072.209] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0072.209] lstrlenW (lpString=".ppt") returned 4 [0072.209] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0072.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.209] lstrlenW (lpString=".zip") returned 4 [0072.209] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0072.209] lstrlenW (lpString=".rar") returned 4 [0072.209] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0072.209] lstrlenW (lpString=".bz2") returned 4 [0072.209] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0072.209] lstrlenW (lpString=".7z") returned 3 [0072.209] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0072.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.209] lstrlenW (lpString=".dbf") returned 4 [0072.209] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0072.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.209] lstrlenW (lpString=".1cd") returned 4 [0072.209] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0072.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0072.209] lstrlenW (lpString=".jpg") returned 4 [0072.209] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0072.209] lstrcmpiW (lpString1=".wmf", lpString2=".beets") returned 1 [0072.209] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0072.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.210] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=7498) returned 1 [0072.210] CloseHandle (hObject=0x190) returned 1 [0072.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0072.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.210] lstrlenW (lpString=".doc") returned 4 [0072.210] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0072.210] lstrlenW (lpString=".docx") returned 5 [0072.210] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0072.210] lstrlenW (lpString=".pdf") returned 4 [0072.210] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0072.210] lstrlenW (lpString=".xls") returned 4 [0072.210] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0072.210] lstrlenW (lpString=".xlsx") returned 5 [0072.210] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0072.210] lstrlenW (lpString=".ppt") returned 4 [0072.210] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.211] lstrlenW (lpString=".zip") returned 4 [0072.211] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0072.211] lstrlenW (lpString=".rar") returned 4 [0072.211] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString=".bz2") returned 4 [0072.211] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString=".7z") returned 3 [0072.211] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0072.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.211] lstrlenW (lpString=".dbf") returned 4 [0072.211] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.211] lstrlenW (lpString=".1cd") returned 4 [0072.211] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.211] lstrlenW (lpString=".jpg") returned 4 [0072.211] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.211] lstrlenW (lpString=".doc") returned 4 [0072.211] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString=".docx") returned 5 [0072.211] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0072.211] lstrlenW (lpString=".pdf") returned 4 [0072.211] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString=".xls") returned 4 [0072.211] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0072.211] lstrlenW (lpString=".xlsx") returned 5 [0072.211] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0072.211] lstrlenW (lpString=".ppt") returned 4 [0072.211] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0072.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.211] lstrlenW (lpString=".zip") returned 4 [0072.211] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0072.211] lstrlenW (lpString=".rar") returned 4 [0072.211] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0072.212] lstrlenW (lpString=".bz2") returned 4 [0072.212] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0072.212] lstrlenW (lpString=".7z") returned 3 [0072.212] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0072.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.212] lstrlenW (lpString=".dbf") returned 4 [0072.212] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0072.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.212] lstrlenW (lpString=".1cd") returned 4 [0072.212] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0072.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0072.212] lstrlenW (lpString=".jpg") returned 4 [0072.212] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0072.212] lstrcmpiW (lpString1=".htm", lpString2=".beets") returned 1 [0072.212] lstrlenW (lpString="Hand Prints.htm") returned 15 [0072.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.213] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=235) returned 1 [0072.213] CloseHandle (hObject=0x190) returned 1 [0072.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0072.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.213] lstrlenW (lpString=".doc") returned 4 [0072.213] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0072.213] lstrlenW (lpString=".docx") returned 5 [0072.213] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0072.213] lstrlenW (lpString=".pdf") returned 4 [0072.213] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0072.213] lstrlenW (lpString=".xls") returned 4 [0072.213] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0072.213] lstrlenW (lpString=".xlsx") returned 5 [0072.213] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0072.213] lstrlenW (lpString=".ppt") returned 4 [0072.213] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0072.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.213] lstrlenW (lpString=".zip") returned 4 [0072.213] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0072.213] lstrlenW (lpString=".rar") returned 4 [0072.214] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0072.214] lstrlenW (lpString=".bz2") returned 4 [0072.214] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0072.214] lstrlenW (lpString=".7z") returned 3 [0072.214] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0072.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.214] lstrlenW (lpString=".dbf") returned 4 [0072.214] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0072.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.214] lstrlenW (lpString=".1cd") returned 4 [0072.214] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0072.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.214] lstrlenW (lpString=".jpg") returned 4 [0072.214] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0072.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.214] lstrlenW (lpString=".doc") returned 4 [0072.214] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0072.214] lstrlenW (lpString=".docx") returned 5 [0072.214] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0072.214] lstrlenW (lpString=".pdf") returned 4 [0072.214] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0072.214] lstrlenW (lpString=".xls") returned 4 [0072.214] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0072.214] lstrlenW (lpString=".xlsx") returned 5 [0072.214] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0072.214] lstrlenW (lpString=".ppt") returned 4 [0072.214] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0072.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.214] lstrlenW (lpString=".zip") returned 4 [0072.214] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0072.214] lstrlenW (lpString=".rar") returned 4 [0072.214] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0072.214] lstrlenW (lpString=".bz2") returned 4 [0072.214] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0072.214] lstrlenW (lpString=".7z") returned 3 [0072.214] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0072.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.215] lstrlenW (lpString=".dbf") returned 4 [0072.215] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0072.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.215] lstrlenW (lpString=".1cd") returned 4 [0072.215] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0072.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0072.215] lstrlenW (lpString=".jpg") returned 4 [0072.215] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0072.215] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.215] lstrlenW (lpString="HandPrints.jpg") returned 14 [0072.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.215] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4222) returned 1 [0072.215] CloseHandle (hObject=0x190) returned 1 [0072.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0072.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.215] lstrlenW (lpString=".doc") returned 4 [0072.216] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.216] lstrlenW (lpString=".docx") returned 5 [0072.216] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0072.216] lstrlenW (lpString=".pdf") returned 4 [0072.216] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.216] lstrlenW (lpString=".xls") returned 4 [0072.216] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.216] lstrlenW (lpString=".xlsx") returned 5 [0072.216] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0072.216] lstrlenW (lpString=".ppt") returned 4 [0072.216] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.216] lstrlenW (lpString=".zip") returned 4 [0072.216] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.216] lstrlenW (lpString=".rar") returned 4 [0072.216] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.216] lstrlenW (lpString=".bz2") returned 4 [0072.216] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.216] lstrlenW (lpString=".7z") returned 3 [0072.216] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.216] lstrlenW (lpString=".dbf") returned 4 [0072.216] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.216] lstrlenW (lpString=".1cd") returned 4 [0072.216] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.216] lstrlenW (lpString=".jpg") returned 4 [0072.216] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.216] lstrlenW (lpString=".doc") returned 4 [0072.216] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.216] lstrlenW (lpString=".docx") returned 5 [0072.216] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0072.216] lstrlenW (lpString=".pdf") returned 4 [0072.216] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.217] lstrlenW (lpString=".xls") returned 4 [0072.217] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.217] lstrlenW (lpString=".xlsx") returned 5 [0072.217] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0072.217] lstrlenW (lpString=".ppt") returned 4 [0072.217] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.217] lstrlenW (lpString=".zip") returned 4 [0072.217] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.217] lstrlenW (lpString=".rar") returned 4 [0072.217] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.217] lstrlenW (lpString=".bz2") returned 4 [0072.217] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.217] lstrlenW (lpString=".7z") returned 3 [0072.217] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.217] lstrlenW (lpString=".dbf") returned 4 [0072.217] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.217] lstrlenW (lpString=".1cd") returned 4 [0072.217] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0072.217] lstrlenW (lpString=".jpg") returned 4 [0072.217] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.217] lstrcmpiW (lpString1=".emf", lpString2=".beets") returned 1 [0072.217] lstrlenW (lpString="Memo.emf") returned 8 [0072.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.220] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=152300) returned 1 [0072.220] CloseHandle (hObject=0x190) returned 1 [0072.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0072.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0072.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0072.221] lstrlenW (lpString=".doc") returned 4 [0072.221] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.221] lstrlenW (lpString=".docx") returned 5 [0072.221] lstrcmpiW (lpString1=".docx", lpString2="o.emf") returned -1 [0072.221] lstrlenW (lpString=".pdf") returned 4 [0072.221] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.221] lstrlenW (lpString=".xls") returned 4 [0072.221] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.221] lstrlenW (lpString=".xlsx") returned 5 [0072.221] lstrcmpiW (lpString1=".xlsx", lpString2="o.emf") returned -1 [0072.221] lstrlenW (lpString=".ppt") returned 4 [0072.221] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0072.221] lstrlenW (lpString=".zip") returned 4 [0072.221] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.221] lstrlenW (lpString=".rar") returned 4 [0072.221] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.221] lstrlenW (lpString=".bz2") returned 4 [0072.221] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.221] lstrlenW (lpString=".7z") returned 3 [0072.221] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0072.221] lstrlenW (lpString=".dbf") returned 4 [0072.221] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.710] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.710] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.229] GetLastError () returned 0x0 [0073.229] ReadFile (in: hFile=0x1b4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0xba9, lpOverlapped=0x0) returned 1 [0073.509] WriteFile (in: hFile=0x180, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0073.510] ReadFile (in: hFile=0x1b4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.510] WriteFile (in: hFile=0x180, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0073.510] SetEndOfFile (hFile=0x180) returned 1 [0073.510] CloseHandle (hObject=0x180) returned 1 [0073.511] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.511] SetEndOfFile (hFile=0x1b4) returned 1 [0073.511] CloseHandle (hObject=0x1b4) returned 1 [0073.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0073.512] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0073.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.515] lstrlenW (lpString=".doc") returned 4 [0073.515] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.515] lstrlenW (lpString=".docx") returned 5 [0073.515] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0073.515] lstrlenW (lpString=".pdf") returned 4 [0073.515] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.515] lstrlenW (lpString=".xls") returned 4 [0073.515] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.515] lstrlenW (lpString=".xlsx") returned 5 [0073.515] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0073.515] lstrlenW (lpString=".ppt") returned 4 [0073.515] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.515] lstrlenW (lpString=".zip") returned 4 [0073.515] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.515] lstrlenW (lpString=".rar") returned 4 [0073.515] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.515] lstrlenW (lpString=".bz2") returned 4 [0073.515] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.515] lstrlenW (lpString=".7z") returned 3 [0073.515] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.515] lstrlenW (lpString=".dbf") returned 4 [0073.515] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.515] lstrlenW (lpString=".1cd") returned 4 [0073.515] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.515] lstrlenW (lpString=".jpg") returned 4 [0073.515] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.516] lstrlenW (lpString=".doc") returned 4 [0073.516] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.516] lstrlenW (lpString=".docx") returned 5 [0073.516] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0073.516] lstrlenW (lpString=".pdf") returned 4 [0073.516] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString=".xls") returned 4 [0073.516] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString=".xlsx") returned 5 [0073.516] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0073.516] lstrlenW (lpString=".ppt") returned 4 [0073.516] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.516] lstrlenW (lpString=".zip") returned 4 [0073.516] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString=".rar") returned 4 [0073.516] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString=".bz2") returned 4 [0073.516] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.516] lstrlenW (lpString=".7z") returned 3 [0073.516] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.516] lstrlenW (lpString=".dbf") returned 4 [0073.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.516] lstrlenW (lpString=".1cd") returned 4 [0073.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0073.516] lstrlenW (lpString=".jpg") returned 4 [0073.517] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.517] lstrcmpiW (lpString1=".PNG", lpString2=".beets") returned 1 [0073.517] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0073.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0073.726] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=34916) returned 1 [0073.726] CloseHandle (hObject=0x160) returned 1 [0073.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0073.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0073.726] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.726] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.727] GetLastError () returned 0x0 [0073.727] ReadFile (in: hFile=0x160, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x8864, lpOverlapped=0x0) returned 1 [0073.816] WriteFile (in: hFile=0x210, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0073.817] ReadFile (in: hFile=0x160, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.817] WriteFile (in: hFile=0x210, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.817] SetEndOfFile (hFile=0x210) returned 1 [0073.817] CloseHandle (hObject=0x210) returned 1 [0073.818] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.818] SetEndOfFile (hFile=0x160) returned 1 [0073.818] CloseHandle (hObject=0x160) returned 1 [0073.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0073.819] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.819] lstrlenW (lpString=".doc") returned 4 [0073.819] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0073.819] lstrlenW (lpString=".docx") returned 5 [0073.819] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0073.819] lstrlenW (lpString=".pdf") returned 4 [0073.819] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0073.819] lstrlenW (lpString=".xls") returned 4 [0073.819] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0073.819] lstrlenW (lpString=".xlsx") returned 5 [0073.819] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0073.819] lstrlenW (lpString=".ppt") returned 4 [0073.819] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0073.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.820] lstrlenW (lpString=".zip") returned 4 [0073.820] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0073.820] lstrlenW (lpString=".rar") returned 4 [0073.820] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0073.820] lstrlenW (lpString=".bz2") returned 4 [0073.820] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0073.820] lstrlenW (lpString=".7z") returned 3 [0073.820] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.820] lstrlenW (lpString=".dbf") returned 4 [0073.820] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.820] lstrlenW (lpString=".1cd") returned 4 [0073.820] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.820] lstrlenW (lpString=".jpg") returned 4 [0073.820] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.820] lstrlenW (lpString=".doc") returned 4 [0073.820] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0073.820] lstrlenW (lpString=".docx") returned 5 [0073.820] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0073.820] lstrlenW (lpString=".pdf") returned 4 [0073.820] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0073.820] lstrlenW (lpString=".xls") returned 4 [0073.820] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0073.820] lstrlenW (lpString=".xlsx") returned 5 [0073.820] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0073.821] lstrlenW (lpString=".ppt") returned 4 [0073.821] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0073.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.821] lstrlenW (lpString=".zip") returned 4 [0073.821] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0073.821] lstrlenW (lpString=".rar") returned 4 [0073.821] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0073.821] lstrlenW (lpString=".bz2") returned 4 [0073.821] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0073.821] lstrlenW (lpString=".7z") returned 3 [0073.821] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0073.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.821] lstrlenW (lpString=".dbf") returned 4 [0073.821] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0073.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.821] lstrlenW (lpString=".1cd") returned 4 [0073.821] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0073.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0073.821] lstrlenW (lpString=".jpg") returned 4 [0073.821] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0073.821] lstrcmpiW (lpString1=".GIF", lpString2=".beets") returned 1 [0073.821] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0073.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0073.822] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1560) returned 1 [0073.822] CloseHandle (hObject=0x160) returned 1 [0073.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0073.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0073.822] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.822] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0074.165] GetLastError () returned 0x0 [0074.165] ReadFile (hFile=0x160, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0) Thread: id = 13 os_tid = 0xa68 [0051.602] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x6c0a88 [0051.637] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x3870048 [0051.638] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630360 [0051.638] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6330a0 [0051.638] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630378 [0051.638] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3970020 [0051.638] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630390 [0051.638] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630390, Size=0x20) returned 0x65fe78 [0051.638] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630390 [0051.638] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630390, Size=0x20) returned 0x65fec8 [0051.639] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0051.639] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0051.639] Wow64DisableWow64FsRedirection (in: OldValue=0x2dbff58 | out: OldValue=0x2dbff58*=0x0) returned 1 [0051.639] lstrlenW (lpString="kernel32.dll") returned 12 [0051.639] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fe78 | out: hHeap=0x5e0000) returned 1 [0051.639] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0051.639] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fec8 | out: hHeap=0x5e0000) returned 1 [0051.639] Sleep (dwMilliseconds=0x64) [0051.757] lstrcmpiW (lpString1=".LOG2", lpString2=".beets") returned 1 [0051.757] lstrlenW (lpString="BCD.LOG2") returned 8 [0051.757] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0052.208] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=0) returned 1 [0052.208] CloseHandle (hObject=0x16c) returned 1 [0052.208] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.208] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.208] lstrlenW (lpString=".doc") returned 4 [0052.208] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0052.208] lstrlenW (lpString=".docx") returned 5 [0052.208] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0052.208] lstrlenW (lpString=".pdf") returned 4 [0052.208] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0052.208] lstrlenW (lpString=".xls") returned 4 [0052.208] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0052.208] lstrlenW (lpString=".xlsx") returned 5 [0052.208] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0052.208] lstrlenW (lpString=".ppt") returned 4 [0052.208] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0052.208] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.208] lstrlenW (lpString=".zip") returned 4 [0052.208] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0052.208] lstrlenW (lpString=".rar") returned 4 [0052.208] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0052.208] lstrlenW (lpString=".bz2") returned 4 [0052.209] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0052.209] lstrlenW (lpString=".7z") returned 3 [0052.209] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0052.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.209] lstrlenW (lpString=".dbf") returned 4 [0052.209] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0052.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.209] lstrlenW (lpString=".1cd") returned 4 [0052.209] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0052.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.209] lstrlenW (lpString=".jpg") returned 4 [0052.209] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0052.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.209] lstrlenW (lpString=".doc") returned 4 [0052.209] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0052.209] lstrlenW (lpString=".docx") returned 5 [0052.209] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0052.209] lstrlenW (lpString=".pdf") returned 4 [0052.209] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0052.209] lstrlenW (lpString=".xls") returned 4 [0052.209] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0052.209] lstrlenW (lpString=".xlsx") returned 5 [0052.209] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0052.209] lstrlenW (lpString=".ppt") returned 4 [0052.209] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0052.209] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.210] lstrlenW (lpString=".zip") returned 4 [0052.210] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0052.210] lstrlenW (lpString=".rar") returned 4 [0052.210] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0052.210] lstrlenW (lpString=".bz2") returned 4 [0052.210] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0052.210] lstrlenW (lpString=".7z") returned 3 [0052.210] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0052.210] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.210] lstrlenW (lpString=".dbf") returned 4 [0052.210] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0052.210] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.210] lstrlenW (lpString=".1cd") returned 4 [0052.210] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0052.210] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.210] lstrlenW (lpString=".jpg") returned 4 [0052.210] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0052.210] Sleep (dwMilliseconds=0x64) [0052.413] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0052.414] lstrlenW (lpString="PptLR.cab") returned 9 [0052.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.558] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=70361744) returned 1 [0052.558] CloseHandle (hObject=0x184) returned 1 [0052.558] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0052.558] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.558] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0052.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.559] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.559] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.559] ReadFile (in: hFile=0x184, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.579] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.579] ReadFile (in: hFile=0x184, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.596] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.596] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.596] ReadFile (in: hFile=0x184, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.736] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.736] WriteFile (in: hFile=0x184, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0052.810] SetEndOfFile (hFile=0x184) returned 1 [0052.810] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3ee1060 [0052.891] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.892] WriteFile (in: hFile=0x184, lpBuffer=0x3ee1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee1060*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.893] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.893] WriteFile (in: hFile=0x184, lpBuffer=0x3ee1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee1060*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.893] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.893] WriteFile (in: hFile=0x184, lpBuffer=0x3ee1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee1060*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.895] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ee1060 | out: hHeap=0x5e0000) returned 1 [0052.928] CloseHandle (hObject=0x184) returned 1 [0056.295] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.295] lstrlenW (lpString=".doc") returned 4 [0056.295] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.295] lstrlenW (lpString=".docx") returned 5 [0056.295] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.295] lstrlenW (lpString=".pdf") returned 4 [0056.295] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.295] lstrlenW (lpString=".xls") returned 4 [0056.295] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.295] lstrlenW (lpString=".xlsx") returned 5 [0056.295] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.295] lstrlenW (lpString=".ppt") returned 4 [0056.295] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.295] lstrlenW (lpString=".zip") returned 4 [0056.295] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.295] lstrlenW (lpString=".rar") returned 4 [0056.295] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.295] lstrlenW (lpString=".bz2") returned 4 [0056.295] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.295] lstrlenW (lpString=".7z") returned 3 [0056.295] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.296] lstrlenW (lpString=".dbf") returned 4 [0056.296] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.296] lstrlenW (lpString=".1cd") returned 4 [0056.296] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.296] lstrlenW (lpString=".jpg") returned 4 [0056.296] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.296] lstrlenW (lpString=".doc") returned 4 [0056.296] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.296] lstrlenW (lpString=".docx") returned 5 [0056.296] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.296] lstrlenW (lpString=".pdf") returned 4 [0056.296] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.296] lstrlenW (lpString=".xls") returned 4 [0056.296] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.296] lstrlenW (lpString=".xlsx") returned 5 [0056.296] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.296] lstrlenW (lpString=".ppt") returned 4 [0056.296] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.296] lstrlenW (lpString=".zip") returned 4 [0056.296] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.296] lstrlenW (lpString=".rar") returned 4 [0056.296] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.296] lstrlenW (lpString=".bz2") returned 4 [0056.296] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.296] lstrlenW (lpString=".7z") returned 3 [0056.296] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.297] lstrlenW (lpString=".dbf") returned 4 [0056.297] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.297] lstrlenW (lpString=".1cd") returned 4 [0056.297] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0056.297] lstrlenW (lpString=".jpg") returned 4 [0056.297] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.297] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0056.297] lstrlenW (lpString="WordLR.cab") returned 10 [0056.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.297] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=43806141) returned 1 [0056.297] CloseHandle (hObject=0x184) returned 1 [0056.297] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0056.297] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.297] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0056.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.298] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0056.298] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.299] ReadFile (in: hFile=0x184, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.559] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.559] ReadFile (in: hFile=0x184, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.876] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.876] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.876] ReadFile (in: hFile=0x184, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.218] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.218] WriteFile (in: hFile=0x184, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0058.032] SetEndOfFile (hFile=0x184) returned 1 [0058.032] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0058.037] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.037] WriteFile (in: hFile=0x184, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.131] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.131] WriteFile (in: hFile=0x184, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.134] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.134] WriteFile (in: hFile=0x184, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.136] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0058.136] CloseHandle (hObject=0x184) returned 1 [0060.147] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0060.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.148] lstrlenW (lpString=".doc") returned 4 [0060.148] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.148] lstrlenW (lpString=".docx") returned 5 [0060.148] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0060.148] lstrlenW (lpString=".pdf") returned 4 [0060.148] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.148] lstrlenW (lpString=".xls") returned 4 [0060.148] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.148] lstrlenW (lpString=".xlsx") returned 5 [0060.148] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0060.148] lstrlenW (lpString=".ppt") returned 4 [0060.148] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.148] lstrlenW (lpString=".zip") returned 4 [0060.148] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.148] lstrlenW (lpString=".rar") returned 4 [0060.148] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.148] lstrlenW (lpString=".bz2") returned 4 [0060.148] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.148] lstrlenW (lpString=".7z") returned 3 [0060.149] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.149] lstrlenW (lpString=".dbf") returned 4 [0060.149] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.149] lstrlenW (lpString=".1cd") returned 4 [0060.149] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.149] lstrlenW (lpString=".jpg") returned 4 [0060.149] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.149] lstrlenW (lpString=".doc") returned 4 [0060.149] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.149] lstrlenW (lpString=".docx") returned 5 [0060.149] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0060.149] lstrlenW (lpString=".pdf") returned 4 [0060.149] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.149] lstrlenW (lpString=".xls") returned 4 [0060.149] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.149] lstrlenW (lpString=".xlsx") returned 5 [0060.150] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0060.150] lstrlenW (lpString=".ppt") returned 4 [0060.150] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.150] lstrlenW (lpString=".zip") returned 4 [0060.150] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.150] lstrlenW (lpString=".rar") returned 4 [0060.150] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.150] lstrlenW (lpString=".bz2") returned 4 [0060.150] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.150] lstrlenW (lpString=".7z") returned 3 [0060.150] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.150] lstrlenW (lpString=".dbf") returned 4 [0060.150] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.150] lstrlenW (lpString=".1cd") returned 4 [0060.150] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0060.150] lstrlenW (lpString=".jpg") returned 4 [0060.150] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.150] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0060.150] lstrlenW (lpString="Proof.msi") returned 9 [0060.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.151] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=875520) returned 1 [0060.151] CloseHandle (hObject=0x184) returned 1 [0060.151] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0060.151] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.151] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.151] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.152] GetLastError () returned 0x0 [0060.152] ReadFile (in: hFile=0x184, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0060.339] WriteFile (in: hFile=0x1a4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0060.354] ReadFile (in: hFile=0x184, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.354] WriteFile (in: hFile=0x1a4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.354] SetEndOfFile (hFile=0x1a4) returned 1 [0060.355] CloseHandle (hObject=0x1a4) returned 1 [0060.361] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.361] SetEndOfFile (hFile=0x184) returned 1 [0060.363] CloseHandle (hObject=0x184) returned 1 [0060.363] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0060.364] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0060.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.364] lstrlenW (lpString=".doc") returned 4 [0060.364] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.364] lstrlenW (lpString=".docx") returned 5 [0060.365] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0060.365] lstrlenW (lpString=".pdf") returned 4 [0060.365] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.365] lstrlenW (lpString=".xls") returned 4 [0060.365] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.365] lstrlenW (lpString=".xlsx") returned 5 [0060.365] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0060.365] lstrlenW (lpString=".ppt") returned 4 [0060.365] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.365] lstrlenW (lpString=".zip") returned 4 [0060.365] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.365] lstrlenW (lpString=".rar") returned 4 [0060.365] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.365] lstrlenW (lpString=".bz2") returned 4 [0060.365] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.365] lstrlenW (lpString=".7z") returned 3 [0060.365] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.366] lstrlenW (lpString=".dbf") returned 4 [0060.366] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.366] lstrlenW (lpString=".1cd") returned 4 [0060.366] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.366] lstrlenW (lpString=".jpg") returned 4 [0060.366] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.366] lstrlenW (lpString=".doc") returned 4 [0060.366] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.366] lstrlenW (lpString=".docx") returned 5 [0060.366] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0060.366] lstrlenW (lpString=".pdf") returned 4 [0060.366] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.366] lstrlenW (lpString=".xls") returned 4 [0060.366] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.366] lstrlenW (lpString=".xlsx") returned 5 [0060.366] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0060.366] lstrlenW (lpString=".ppt") returned 4 [0060.367] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.367] lstrlenW (lpString=".zip") returned 4 [0060.367] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.367] lstrlenW (lpString=".rar") returned 4 [0060.367] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.367] lstrlenW (lpString=".bz2") returned 4 [0060.367] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.367] lstrlenW (lpString=".7z") returned 3 [0060.367] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.367] lstrlenW (lpString=".dbf") returned 4 [0060.367] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.367] lstrlenW (lpString=".1cd") returned 4 [0060.367] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0060.367] lstrlenW (lpString=".jpg") returned 4 [0060.367] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.367] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0060.367] lstrlenW (lpString="Proof.msi") returned 9 [0060.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.696] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=881152) returned 1 [0060.696] CloseHandle (hObject=0x184) returned 1 [0060.697] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0060.697] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.697] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.697] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.697] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.697] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.698] GetLastError () returned 0x0 [0060.698] ReadFile (in: hFile=0x184, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xd7200, lpOverlapped=0x0) returned 1 [0061.013] WriteFile (in: hFile=0x1a4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0061.029] ReadFile (in: hFile=0x184, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.029] WriteFile (in: hFile=0x1a4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.029] SetEndOfFile (hFile=0x1a4) returned 1 [0061.029] CloseHandle (hObject=0x1a4) returned 1 [0061.038] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.038] SetEndOfFile (hFile=0x184) returned 1 [0061.128] CloseHandle (hObject=0x184) returned 1 [0061.128] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0061.129] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0061.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.129] lstrlenW (lpString=".doc") returned 4 [0061.129] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.129] lstrlenW (lpString=".docx") returned 5 [0061.129] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0061.129] lstrlenW (lpString=".pdf") returned 4 [0061.129] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.129] lstrlenW (lpString=".xls") returned 4 [0061.129] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0061.129] lstrlenW (lpString=".xlsx") returned 5 [0061.129] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0061.129] lstrlenW (lpString=".ppt") returned 4 [0061.129] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.129] lstrlenW (lpString=".zip") returned 4 [0061.129] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0061.129] lstrlenW (lpString=".rar") returned 4 [0061.129] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.129] lstrlenW (lpString=".bz2") returned 4 [0061.130] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.130] lstrlenW (lpString=".7z") returned 3 [0061.130] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.130] lstrlenW (lpString=".dbf") returned 4 [0061.130] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.130] lstrlenW (lpString=".1cd") returned 4 [0061.130] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.130] lstrlenW (lpString=".jpg") returned 4 [0061.130] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.130] lstrlenW (lpString=".doc") returned 4 [0061.130] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.130] lstrlenW (lpString=".docx") returned 5 [0061.130] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0061.132] lstrlenW (lpString=".pdf") returned 4 [0061.132] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.132] lstrlenW (lpString=".xls") returned 4 [0061.132] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0061.132] lstrlenW (lpString=".xlsx") returned 5 [0061.132] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0061.132] lstrlenW (lpString=".ppt") returned 4 [0061.132] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.132] lstrlenW (lpString=".zip") returned 4 [0061.132] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0061.132] lstrlenW (lpString=".rar") returned 4 [0061.132] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.132] lstrlenW (lpString=".bz2") returned 4 [0061.132] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.132] lstrlenW (lpString=".7z") returned 3 [0061.132] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.132] lstrlenW (lpString=".dbf") returned 4 [0061.132] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.132] lstrlenW (lpString=".1cd") returned 4 [0061.132] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0061.132] lstrlenW (lpString=".jpg") returned 4 [0061.132] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.133] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0061.133] lstrlenW (lpString="Proof.msi") returned 9 [0061.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.133] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=885760) returned 1 [0061.133] CloseHandle (hObject=0x184) returned 1 [0061.133] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0061.134] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.135] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.135] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.136] GetLastError () returned 0x0 [0061.136] ReadFile (in: hFile=0x184, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xd8400, lpOverlapped=0x0) returned 1 [0061.268] WriteFile (in: hFile=0x1a4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0061.287] ReadFile (in: hFile=0x184, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.287] WriteFile (in: hFile=0x1a4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.287] SetEndOfFile (hFile=0x1a4) returned 1 [0061.288] CloseHandle (hObject=0x1a4) returned 1 [0061.725] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.725] SetEndOfFile (hFile=0x184) returned 1 [0061.727] CloseHandle (hObject=0x184) returned 1 [0061.727] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0061.728] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0061.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.728] lstrlenW (lpString=".doc") returned 4 [0061.728] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.728] lstrlenW (lpString=".docx") returned 5 [0061.728] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0061.728] lstrlenW (lpString=".pdf") returned 4 [0061.728] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.728] lstrlenW (lpString=".xls") returned 4 [0061.728] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0061.728] lstrlenW (lpString=".xlsx") returned 5 [0061.728] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0061.728] lstrlenW (lpString=".ppt") returned 4 [0061.728] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.728] lstrlenW (lpString=".zip") returned 4 [0061.728] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0061.728] lstrlenW (lpString=".rar") returned 4 [0061.728] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.729] lstrlenW (lpString=".bz2") returned 4 [0061.729] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.729] lstrlenW (lpString=".7z") returned 3 [0061.729] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.729] lstrlenW (lpString=".dbf") returned 4 [0061.729] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.729] lstrlenW (lpString=".1cd") returned 4 [0061.729] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.729] lstrlenW (lpString=".jpg") returned 4 [0061.729] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.729] lstrlenW (lpString=".doc") returned 4 [0061.729] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.729] lstrlenW (lpString=".docx") returned 5 [0061.729] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0061.729] lstrlenW (lpString=".pdf") returned 4 [0061.729] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.729] lstrlenW (lpString=".xls") returned 4 [0061.729] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0061.729] lstrlenW (lpString=".xlsx") returned 5 [0061.729] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0061.729] lstrlenW (lpString=".ppt") returned 4 [0061.729] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.730] lstrlenW (lpString=".zip") returned 4 [0061.730] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0061.730] lstrlenW (lpString=".rar") returned 4 [0061.730] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.730] lstrlenW (lpString=".bz2") returned 4 [0061.730] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.730] lstrlenW (lpString=".7z") returned 3 [0061.730] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.730] lstrlenW (lpString=".dbf") returned 4 [0061.730] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.730] lstrlenW (lpString=".1cd") returned 4 [0061.730] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0061.730] lstrlenW (lpString=".jpg") returned 4 [0061.730] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.730] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0061.730] lstrlenW (lpString="Proofing.msi") returned 12 [0061.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.731] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=868864) returned 1 [0061.731] CloseHandle (hObject=0x184) returned 1 [0061.731] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0061.731] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.731] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.731] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.732] GetLastError () returned 0x0 [0061.732] ReadFile (in: hFile=0x184, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x1a4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0061.850] ReadFile (in: hFile=0x184, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x1a4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.850] SetEndOfFile (hFile=0x1a4) returned 1 [0061.850] CloseHandle (hObject=0x1a4) returned 1 [0061.961] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.961] SetEndOfFile (hFile=0x184) returned 1 [0061.968] CloseHandle (hObject=0x184) returned 1 [0061.968] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0061.968] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0061.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.969] lstrlenW (lpString=".doc") returned 4 [0061.969] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.969] lstrlenW (lpString=".docx") returned 5 [0061.969] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0061.969] lstrlenW (lpString=".pdf") returned 4 [0061.969] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.969] lstrlenW (lpString=".xls") returned 4 [0061.969] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0061.969] lstrlenW (lpString=".xlsx") returned 5 [0061.969] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0061.969] lstrlenW (lpString=".ppt") returned 4 [0061.969] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.969] lstrlenW (lpString=".zip") returned 4 [0061.969] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0061.969] lstrlenW (lpString=".rar") returned 4 [0061.969] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.969] lstrlenW (lpString=".bz2") returned 4 [0061.969] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.969] lstrlenW (lpString=".7z") returned 3 [0061.969] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.969] lstrlenW (lpString=".dbf") returned 4 [0061.969] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.970] lstrlenW (lpString=".1cd") returned 4 [0061.970] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.970] lstrlenW (lpString=".jpg") returned 4 [0061.970] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.970] lstrlenW (lpString=".doc") returned 4 [0061.970] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.970] lstrlenW (lpString=".docx") returned 5 [0061.970] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0061.970] lstrlenW (lpString=".pdf") returned 4 [0061.970] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.970] lstrlenW (lpString=".xls") returned 4 [0061.970] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0061.970] lstrlenW (lpString=".xlsx") returned 5 [0061.970] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0061.970] lstrlenW (lpString=".ppt") returned 4 [0061.970] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.970] lstrlenW (lpString=".zip") returned 4 [0061.970] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0061.970] lstrlenW (lpString=".rar") returned 4 [0061.970] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.970] lstrlenW (lpString=".bz2") returned 4 [0061.970] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.970] lstrlenW (lpString=".7z") returned 3 [0061.970] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.971] lstrlenW (lpString=".dbf") returned 4 [0061.971] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.971] lstrlenW (lpString=".1cd") returned 4 [0061.971] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0061.971] lstrlenW (lpString=".jpg") returned 4 [0061.971] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.971] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0061.971] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0061.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.971] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2928955) returned 1 [0061.971] CloseHandle (hObject=0x184) returned 1 [0061.971] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0061.972] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.972] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0061.972] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.972] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0061.972] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0061.972] ReadFile (in: hFile=0x184, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.522] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0067.522] ReadFile (in: hFile=0x184, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.705] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0067.705] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0067.705] ReadFile (in: hFile=0x184, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.265] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.265] WriteFile (in: hFile=0x184, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0068.276] SetEndOfFile (hFile=0x184) returned 1 [0068.276] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f64088 [0068.283] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0068.283] WriteFile (in: hFile=0x184, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.284] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0068.284] WriteFile (in: hFile=0x184, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.287] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0068.287] WriteFile (in: hFile=0x184, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.289] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f64088 | out: hHeap=0x5e0000) returned 1 [0068.289] CloseHandle (hObject=0x184) returned 1 [0069.717] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0069.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.717] lstrlenW (lpString=".doc") returned 4 [0069.717] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.717] lstrlenW (lpString=".docx") returned 5 [0069.717] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0069.717] lstrlenW (lpString=".pdf") returned 4 [0069.717] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.717] lstrlenW (lpString=".xls") returned 4 [0069.717] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.717] lstrlenW (lpString=".xlsx") returned 5 [0069.717] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0069.718] lstrlenW (lpString=".ppt") returned 4 [0069.718] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.718] lstrlenW (lpString=".zip") returned 4 [0069.718] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.718] lstrlenW (lpString=".rar") returned 4 [0069.718] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.718] lstrlenW (lpString=".bz2") returned 4 [0069.718] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.718] lstrlenW (lpString=".7z") returned 3 [0069.718] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.718] lstrlenW (lpString=".dbf") returned 4 [0069.718] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.718] lstrlenW (lpString=".1cd") returned 4 [0069.718] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.718] lstrlenW (lpString=".jpg") returned 4 [0069.718] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.719] lstrlenW (lpString=".doc") returned 4 [0069.719] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.719] lstrlenW (lpString=".docx") returned 5 [0069.719] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0069.719] lstrlenW (lpString=".pdf") returned 4 [0069.719] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.719] lstrlenW (lpString=".xls") returned 4 [0069.719] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.719] lstrlenW (lpString=".xlsx") returned 5 [0069.719] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0069.719] lstrlenW (lpString=".ppt") returned 4 [0069.719] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.719] lstrlenW (lpString=".zip") returned 4 [0069.719] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.719] lstrlenW (lpString=".rar") returned 4 [0069.719] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.719] lstrlenW (lpString=".bz2") returned 4 [0069.719] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.719] lstrlenW (lpString=".7z") returned 3 [0069.719] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.719] lstrlenW (lpString=".dbf") returned 4 [0069.719] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.719] lstrlenW (lpString=".1cd") returned 4 [0069.719] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0069.720] lstrlenW (lpString=".jpg") returned 4 [0069.720] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.720] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0069.720] lstrlenW (lpString="VisioLR.cab") returned 11 [0069.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0069.737] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=50823389) returned 1 [0069.738] CloseHandle (hObject=0x210) returned 1 [0069.738] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0069.738] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.738] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0069.738] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0069.738] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0069.739] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0069.739] ReadFile (in: hFile=0x210, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.984] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0069.984] ReadFile (in: hFile=0x210, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.031] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.031] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.031] ReadFile (in: hFile=0x210, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.141] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.141] WriteFile (in: hFile=0x210, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0070.150] SetEndOfFile (hFile=0x210) returned 1 [0070.150] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f64088 [0070.154] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.154] WriteFile (in: hFile=0x210, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.154] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.154] WriteFile (in: hFile=0x210, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.155] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.155] WriteFile (in: hFile=0x210, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.157] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f64088 | out: hHeap=0x5e0000) returned 1 [0070.157] CloseHandle (hObject=0x210) returned 1 [0070.157] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.157] lstrlenW (lpString=".doc") returned 4 [0070.157] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString=".docx") returned 5 [0070.158] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0070.158] lstrlenW (lpString=".pdf") returned 4 [0070.158] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString=".xls") returned 4 [0070.158] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString=".xlsx") returned 5 [0070.158] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0070.158] lstrlenW (lpString=".ppt") returned 4 [0070.158] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.158] lstrlenW (lpString=".zip") returned 4 [0070.158] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString=".rar") returned 4 [0070.158] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString=".bz2") returned 4 [0070.158] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.158] lstrlenW (lpString=".7z") returned 3 [0070.158] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.158] lstrlenW (lpString=".dbf") returned 4 [0070.158] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.158] lstrlenW (lpString=".1cd") returned 4 [0070.158] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.158] lstrlenW (lpString=".jpg") returned 4 [0070.158] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.158] lstrlenW (lpString=".doc") returned 4 [0070.158] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString=".docx") returned 5 [0070.158] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0070.158] lstrlenW (lpString=".pdf") returned 4 [0070.158] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.158] lstrlenW (lpString=".xls") returned 4 [0070.159] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.159] lstrlenW (lpString=".xlsx") returned 5 [0070.159] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0070.159] lstrlenW (lpString=".ppt") returned 4 [0070.159] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.159] lstrlenW (lpString=".zip") returned 4 [0070.159] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.159] lstrlenW (lpString=".rar") returned 4 [0070.159] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.159] lstrlenW (lpString=".bz2") returned 4 [0070.159] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.159] lstrlenW (lpString=".7z") returned 3 [0070.159] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.159] lstrlenW (lpString=".dbf") returned 4 [0070.159] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.159] lstrlenW (lpString=".1cd") returned 4 [0070.159] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0070.159] lstrlenW (lpString=".jpg") returned 4 [0070.159] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.159] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0070.159] lstrlenW (lpString="OnoteLR.cab") returned 11 [0070.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0070.165] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=17456632) returned 1 [0070.165] CloseHandle (hObject=0x1d0) returned 1 [0070.165] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0070.165] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.165] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0070.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0070.166] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0070.166] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.166] ReadFile (in: hFile=0x1d0, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.439] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.439] ReadFile (in: hFile=0x1d0, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.612] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.612] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.612] ReadFile (in: hFile=0x1d0, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.653] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.653] WriteFile (in: hFile=0x1d0, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0070.777] SetEndOfFile (hFile=0x1d0) returned 1 [0070.777] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0070.777] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.777] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.778] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.778] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.778] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.778] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.779] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0070.779] CloseHandle (hObject=0x1d0) returned 1 [0070.779] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.779] lstrlenW (lpString=".doc") returned 4 [0070.779] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.779] lstrlenW (lpString=".docx") returned 5 [0070.779] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0070.779] lstrlenW (lpString=".pdf") returned 4 [0070.779] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.779] lstrlenW (lpString=".xls") returned 4 [0070.779] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.779] lstrlenW (lpString=".xlsx") returned 5 [0070.779] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0070.779] lstrlenW (lpString=".ppt") returned 4 [0070.779] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.779] lstrlenW (lpString=".zip") returned 4 [0070.779] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.779] lstrlenW (lpString=".rar") returned 4 [0070.780] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString=".bz2") returned 4 [0070.780] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.780] lstrlenW (lpString=".7z") returned 3 [0070.780] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.780] lstrlenW (lpString=".dbf") returned 4 [0070.780] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.780] lstrlenW (lpString=".1cd") returned 4 [0070.780] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.780] lstrlenW (lpString=".jpg") returned 4 [0070.780] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.780] lstrlenW (lpString=".doc") returned 4 [0070.780] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString=".docx") returned 5 [0070.780] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0070.780] lstrlenW (lpString=".pdf") returned 4 [0070.780] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString=".xls") returned 4 [0070.780] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString=".xlsx") returned 5 [0070.780] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0070.780] lstrlenW (lpString=".ppt") returned 4 [0070.780] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.780] lstrlenW (lpString=".zip") returned 4 [0070.780] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString=".rar") returned 4 [0070.780] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.780] lstrlenW (lpString=".bz2") returned 4 [0070.780] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.780] lstrlenW (lpString=".7z") returned 3 [0070.780] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.781] lstrlenW (lpString=".dbf") returned 4 [0070.781] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.781] lstrlenW (lpString=".1cd") returned 4 [0070.781] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0070.781] lstrlenW (lpString=".jpg") returned 4 [0070.781] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.781] lstrcmpiW (lpString1=".EXE", lpString2=".beets") returned 1 [0070.781] lstrlenW (lpString="DW20.EXE") returned 8 [0070.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.784] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=838536) returned 1 [0070.784] CloseHandle (hObject=0x190) returned 1 [0070.784] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0070.784] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.784] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.784] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0070.784] GetLastError () returned 0x0 [0070.784] ReadFile (in: hFile=0x190, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xccb88, lpOverlapped=0x0) returned 1 [0070.973] WriteFile (in: hFile=0x160, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0070.984] ReadFile (in: hFile=0x190, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0070.984] WriteFile (in: hFile=0x160, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0070.984] SetEndOfFile (hFile=0x160) returned 1 [0071.194] CloseHandle (hObject=0x160) returned 1 [0071.194] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.194] SetEndOfFile (hFile=0x190) returned 1 [0071.197] CloseHandle (hObject=0x190) returned 1 [0071.197] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.197] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0071.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.197] lstrlenW (lpString=".doc") returned 4 [0071.197] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0071.197] lstrlenW (lpString=".docx") returned 5 [0071.197] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0071.197] lstrlenW (lpString=".pdf") returned 4 [0071.197] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0071.197] lstrlenW (lpString=".xls") returned 4 [0071.198] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0071.198] lstrlenW (lpString=".xlsx") returned 5 [0071.198] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0071.198] lstrlenW (lpString=".ppt") returned 4 [0071.198] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0071.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.198] lstrlenW (lpString=".zip") returned 4 [0071.198] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0071.198] lstrlenW (lpString=".rar") returned 4 [0071.198] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0071.198] lstrlenW (lpString=".bz2") returned 4 [0071.198] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0071.198] lstrlenW (lpString=".7z") returned 3 [0071.198] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0071.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.198] lstrlenW (lpString=".dbf") returned 4 [0071.198] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0071.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.198] lstrlenW (lpString=".1cd") returned 4 [0071.198] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0071.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.198] lstrlenW (lpString=".jpg") returned 4 [0071.198] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0071.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.198] lstrlenW (lpString=".doc") returned 4 [0071.198] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0071.198] lstrlenW (lpString=".docx") returned 5 [0071.198] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0071.198] lstrlenW (lpString=".pdf") returned 4 [0071.198] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0071.198] lstrlenW (lpString=".xls") returned 4 [0071.198] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0071.198] lstrlenW (lpString=".xlsx") returned 5 [0071.198] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0071.198] lstrlenW (lpString=".ppt") returned 4 [0071.198] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0071.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.198] lstrlenW (lpString=".zip") returned 4 [0071.198] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0071.199] lstrlenW (lpString=".rar") returned 4 [0071.199] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0071.199] lstrlenW (lpString=".bz2") returned 4 [0071.199] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0071.199] lstrlenW (lpString=".7z") returned 3 [0071.199] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0071.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.199] lstrlenW (lpString=".dbf") returned 4 [0071.199] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0071.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.199] lstrlenW (lpString=".1cd") returned 4 [0071.199] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0071.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0071.199] lstrlenW (lpString=".jpg") returned 4 [0071.199] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0071.199] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0071.199] lstrlenW (lpString="OfficeLR.cab") returned 12 [0071.199] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0071.199] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=14127746) returned 1 [0071.199] CloseHandle (hObject=0x190) returned 1 [0071.199] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0071.199] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.200] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0071.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0071.200] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0071.200] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.200] ReadFile (in: hFile=0x190, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.347] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.347] ReadFile (in: hFile=0x190, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.466] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.466] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.466] ReadFile (in: hFile=0x190, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.500] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.500] WriteFile (in: hFile=0x190, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0071.517] SetEndOfFile (hFile=0x190) returned 1 [0071.517] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0071.522] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.522] WriteFile (in: hFile=0x190, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.523] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.523] WriteFile (in: hFile=0x190, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.654] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.654] WriteFile (in: hFile=0x190, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.656] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0071.657] CloseHandle (hObject=0x190) returned 1 [0071.774] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.775] lstrlenW (lpString=".doc") returned 4 [0071.775] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.775] lstrlenW (lpString=".docx") returned 5 [0071.775] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0071.775] lstrlenW (lpString=".pdf") returned 4 [0071.775] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.775] lstrlenW (lpString=".xls") returned 4 [0071.775] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.775] lstrlenW (lpString=".xlsx") returned 5 [0071.775] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0071.775] lstrlenW (lpString=".ppt") returned 4 [0071.775] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.775] lstrlenW (lpString=".zip") returned 4 [0071.775] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.775] lstrlenW (lpString=".rar") returned 4 [0071.775] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.775] lstrlenW (lpString=".bz2") returned 4 [0071.775] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.775] lstrlenW (lpString=".7z") returned 3 [0071.776] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.776] lstrlenW (lpString=".dbf") returned 4 [0071.776] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.776] lstrlenW (lpString=".1cd") returned 4 [0071.776] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.776] lstrlenW (lpString=".jpg") returned 4 [0071.776] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.776] lstrlenW (lpString=".doc") returned 4 [0071.776] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.776] lstrlenW (lpString=".docx") returned 5 [0071.776] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0071.776] lstrlenW (lpString=".pdf") returned 4 [0071.776] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.776] lstrlenW (lpString=".xls") returned 4 [0071.776] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.776] lstrlenW (lpString=".xlsx") returned 5 [0071.776] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0071.776] lstrlenW (lpString=".ppt") returned 4 [0071.776] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.776] lstrlenW (lpString=".zip") returned 4 [0071.776] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.776] lstrlenW (lpString=".rar") returned 4 [0071.776] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.776] lstrlenW (lpString=".bz2") returned 4 [0071.777] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.777] lstrlenW (lpString=".7z") returned 3 [0071.777] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.777] lstrlenW (lpString=".dbf") returned 4 [0071.777] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.777] lstrlenW (lpString=".1cd") returned 4 [0071.777] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0071.777] lstrlenW (lpString=".jpg") returned 4 [0071.777] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.777] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0071.777] lstrlenW (lpString="AccessMUI.msi") returned 13 [0071.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0071.778] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2517504) returned 1 [0071.778] CloseHandle (hObject=0x21c) returned 1 [0071.778] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0071.778] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.779] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0071.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0071.779] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0071.779] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.779] ReadFile (in: hFile=0x21c, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.934] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.935] ReadFile (in: hFile=0x21c, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.954] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.954] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.954] ReadFile (in: hFile=0x21c, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.122] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.122] WriteFile (in: hFile=0x21c, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0072.235] SetEndOfFile (hFile=0x21c) returned 1 [0072.263] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0072.267] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.267] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.269] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.269] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.273] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.273] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.275] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0072.275] CloseHandle (hObject=0x21c) returned 1 [0072.275] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0072.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.276] lstrlenW (lpString=".doc") returned 4 [0072.276] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0072.276] lstrlenW (lpString=".docx") returned 5 [0072.276] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0072.276] lstrlenW (lpString=".pdf") returned 4 [0072.276] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0072.276] lstrlenW (lpString=".xls") returned 4 [0072.276] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0072.276] lstrlenW (lpString=".xlsx") returned 5 [0072.276] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0072.276] lstrlenW (lpString=".ppt") returned 4 [0072.276] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0072.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.276] lstrlenW (lpString=".zip") returned 4 [0072.276] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0072.276] lstrlenW (lpString=".rar") returned 4 [0072.276] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0072.276] lstrlenW (lpString=".bz2") returned 4 [0072.276] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0072.276] lstrlenW (lpString=".7z") returned 3 [0072.276] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0072.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.276] lstrlenW (lpString=".dbf") returned 4 [0072.276] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0072.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.276] lstrlenW (lpString=".1cd") returned 4 [0072.276] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0072.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.276] lstrlenW (lpString=".jpg") returned 4 [0072.276] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0072.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.276] lstrlenW (lpString=".doc") returned 4 [0072.276] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0072.276] lstrlenW (lpString=".docx") returned 5 [0072.276] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0072.277] lstrlenW (lpString=".pdf") returned 4 [0072.277] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0072.277] lstrlenW (lpString=".xls") returned 4 [0072.277] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0072.277] lstrlenW (lpString=".xlsx") returned 5 [0072.277] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0072.277] lstrlenW (lpString=".ppt") returned 4 [0072.277] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0072.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.277] lstrlenW (lpString=".zip") returned 4 [0072.277] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0072.277] lstrlenW (lpString=".rar") returned 4 [0072.277] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0072.277] lstrlenW (lpString=".bz2") returned 4 [0072.277] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0072.277] lstrlenW (lpString=".7z") returned 3 [0072.277] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0072.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.277] lstrlenW (lpString=".dbf") returned 4 [0072.277] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0072.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.277] lstrlenW (lpString=".1cd") returned 4 [0072.277] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0072.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0072.277] lstrlenW (lpString=".jpg") returned 4 [0072.277] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0072.277] lstrcmpiW (lpString1=".dll", lpString2=".beets") returned 1 [0072.277] lstrlenW (lpString="osetup.dll") returned 10 [0072.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0072.280] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=7378792) returned 1 [0072.280] CloseHandle (hObject=0x21c) returned 1 [0072.280] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0072.280] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.281] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0072.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0072.281] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0072.281] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0072.281] ReadFile (in: hFile=0x21c, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.310] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0072.310] ReadFile (in: hFile=0x21c, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.393] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0072.393] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0072.393] ReadFile (in: hFile=0x21c, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.646] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.646] WriteFile (in: hFile=0x21c, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0072.660] SetEndOfFile (hFile=0x21c) returned 1 [0072.660] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0072.660] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.660] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.662] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.662] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.681] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.681] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.683] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0072.683] CloseHandle (hObject=0x21c) returned 1 [0072.683] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0072.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.683] lstrlenW (lpString=".doc") returned 4 [0072.683] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.683] lstrlenW (lpString=".docx") returned 5 [0072.683] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0072.683] lstrlenW (lpString=".pdf") returned 4 [0072.683] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.683] lstrlenW (lpString=".xls") returned 4 [0072.683] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.683] lstrlenW (lpString=".xlsx") returned 5 [0072.683] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0072.683] lstrlenW (lpString=".ppt") returned 4 [0072.683] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.684] lstrlenW (lpString=".zip") returned 4 [0072.684] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.684] lstrlenW (lpString=".rar") returned 4 [0072.684] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.684] lstrlenW (lpString=".bz2") returned 4 [0072.684] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.684] lstrlenW (lpString=".7z") returned 3 [0072.684] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.684] lstrlenW (lpString=".dbf") returned 4 [0072.684] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.684] lstrlenW (lpString=".1cd") returned 4 [0072.684] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.684] lstrlenW (lpString=".jpg") returned 4 [0072.684] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.684] lstrlenW (lpString=".doc") returned 4 [0072.684] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.684] lstrlenW (lpString=".docx") returned 5 [0072.684] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0072.684] lstrlenW (lpString=".pdf") returned 4 [0072.684] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.684] lstrlenW (lpString=".xls") returned 4 [0072.684] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.684] lstrlenW (lpString=".xlsx") returned 5 [0072.684] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0072.684] lstrlenW (lpString=".ppt") returned 4 [0072.684] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.685] lstrlenW (lpString=".zip") returned 4 [0072.685] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.685] lstrlenW (lpString=".rar") returned 4 [0072.685] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.685] lstrlenW (lpString=".bz2") returned 4 [0072.685] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.685] lstrlenW (lpString=".7z") returned 3 [0072.685] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.685] lstrlenW (lpString=".dbf") returned 4 [0072.685] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.685] lstrlenW (lpString=".1cd") returned 4 [0072.685] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0072.685] lstrlenW (lpString=".jpg") returned 4 [0072.685] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.685] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0072.685] lstrlenW (lpString="ProPrWW.cab") returned 11 [0072.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0072.703] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=177720283) returned 1 [0072.703] CloseHandle (hObject=0x21c) returned 1 [0072.703] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0072.703] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.703] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0072.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0072.704] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0072.704] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0072.704] ReadFile (in: hFile=0x21c, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.572] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.572] ReadFile (in: hFile=0x21c, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.618] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.618] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.619] ReadFile (in: hFile=0x21c, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.772] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.772] WriteFile (in: hFile=0x21c, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0073.787] SetEndOfFile (hFile=0x21c) returned 1 [0074.082] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0074.082] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.082] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.083] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.083] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.084] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.084] WriteFile (in: hFile=0x21c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.086] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0074.086] CloseHandle (hObject=0x21c) returned 1 [0074.086] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0074.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.087] lstrlenW (lpString=".doc") returned 4 [0074.087] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.087] lstrlenW (lpString=".docx") returned 5 [0074.087] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0074.087] lstrlenW (lpString=".pdf") returned 4 [0074.087] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.087] lstrlenW (lpString=".xls") returned 4 [0074.087] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.087] lstrlenW (lpString=".xlsx") returned 5 [0074.087] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0074.087] lstrlenW (lpString=".ppt") returned 4 [0074.087] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.087] lstrlenW (lpString=".zip") returned 4 [0074.087] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.087] lstrlenW (lpString=".rar") returned 4 [0074.087] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.087] lstrlenW (lpString=".bz2") returned 4 [0074.087] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.087] lstrlenW (lpString=".7z") returned 3 [0074.087] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.087] lstrlenW (lpString=".dbf") returned 4 [0074.087] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.087] lstrlenW (lpString=".1cd") returned 4 [0074.087] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.088] lstrlenW (lpString=".jpg") returned 4 [0074.088] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.088] lstrlenW (lpString=".doc") returned 4 [0074.088] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.088] lstrlenW (lpString=".docx") returned 5 [0074.088] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0074.088] lstrlenW (lpString=".pdf") returned 4 [0074.088] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.088] lstrlenW (lpString=".xls") returned 4 [0074.088] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.088] lstrlenW (lpString=".xlsx") returned 5 [0074.088] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0074.088] lstrlenW (lpString=".ppt") returned 4 [0074.088] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.088] lstrlenW (lpString=".zip") returned 4 [0074.088] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.088] lstrlenW (lpString=".rar") returned 4 [0074.088] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.088] lstrlenW (lpString=".bz2") returned 4 [0074.088] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.088] lstrlenW (lpString=".7z") returned 3 [0074.088] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.088] lstrlenW (lpString=".dbf") returned 4 [0074.088] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.089] lstrlenW (lpString=".1cd") returned 4 [0074.089] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0074.089] lstrlenW (lpString=".jpg") returned 4 [0074.089] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.089] lstrcmpiW (lpString1=".dll", lpString2=".beets") returned 1 [0074.089] lstrlenW (lpString="PidGenX.dll") returned 11 [0074.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0074.089] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1463568) returned 1 [0074.089] CloseHandle (hObject=0x21c) returned 1 [0074.089] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0074.089] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0074.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0074.090] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.090] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0074.090] GetLastError () returned 0x0 [0074.090] ReadFile (in: hFile=0x21c, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0074.203] WriteFile (in: hFile=0x178, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0074.215] ReadFile (hFile=0x21c, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0) Thread: id = 14 os_tid = 0xa6c [0051.639] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x3880260 [0051.640] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x3890268 [0051.640] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630390 [0051.640] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6330b0 [0051.640] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6303a8 [0051.640] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3a80020 [0051.641] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6303c0 [0051.641] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6303c0, Size=0x20) returned 0x65fec8 [0051.641] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6303c0 [0051.641] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6303c0, Size=0x20) returned 0x65fe78 [0051.641] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0051.641] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0051.641] Wow64DisableWow64FsRedirection (in: OldValue=0x2efff58 | out: OldValue=0x2efff58*=0x0) returned 1 [0051.641] lstrlenW (lpString="kernel32.dll") returned 12 [0051.641] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fec8 | out: hHeap=0x5e0000) returned 1 [0051.641] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0051.641] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fe78 | out: hHeap=0x5e0000) returned 1 [0051.641] Sleep (dwMilliseconds=0x64) [0051.757] Sleep (dwMilliseconds=0x64) [0052.201] Sleep (dwMilliseconds=0x64) [0052.387] Sleep (dwMilliseconds=0x64) [0052.556] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0052.556] lstrlenW (lpString="Setup.xml") returned 9 [0052.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.786] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=4207) returned 1 [0052.786] CloseHandle (hObject=0x160) returned 1 [0052.786] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0052.787] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.787] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.787] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.787] GetLastError () returned 0x0 [0052.787] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x106f, lpOverlapped=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x168, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x1070, lpOverlapped=0x0) returned 1 [0053.282] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.282] WriteFile (in: hFile=0x168, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.282] SetEndOfFile (hFile=0x168) returned 1 [0053.282] CloseHandle (hObject=0x168) returned 1 [0053.284] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.284] SetEndOfFile (hFile=0x160) returned 1 [0053.286] CloseHandle (hObject=0x160) returned 1 [0053.286] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0053.286] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0053.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.286] lstrlenW (lpString=".doc") returned 4 [0053.286] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.286] lstrlenW (lpString=".docx") returned 5 [0053.287] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0053.287] lstrlenW (lpString=".pdf") returned 4 [0053.287] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.287] lstrlenW (lpString=".xls") returned 4 [0053.287] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.287] lstrlenW (lpString=".xlsx") returned 5 [0053.287] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0053.287] lstrlenW (lpString=".ppt") returned 4 [0053.287] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.287] lstrlenW (lpString=".zip") returned 4 [0053.287] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.287] lstrlenW (lpString=".rar") returned 4 [0053.287] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.287] lstrlenW (lpString=".bz2") returned 4 [0053.287] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.287] lstrlenW (lpString=".7z") returned 3 [0053.287] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.288] lstrlenW (lpString=".dbf") returned 4 [0053.288] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.288] lstrlenW (lpString=".1cd") returned 4 [0053.288] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.288] lstrlenW (lpString=".jpg") returned 4 [0053.288] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.288] lstrlenW (lpString=".doc") returned 4 [0053.288] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.289] lstrlenW (lpString=".docx") returned 5 [0053.289] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0053.289] lstrlenW (lpString=".pdf") returned 4 [0053.289] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.289] lstrlenW (lpString=".xls") returned 4 [0053.289] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.289] lstrlenW (lpString=".xlsx") returned 5 [0053.289] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0053.289] lstrlenW (lpString=".ppt") returned 4 [0053.289] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.289] lstrlenW (lpString=".zip") returned 4 [0053.289] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.289] lstrlenW (lpString=".rar") returned 4 [0053.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.289] lstrlenW (lpString=".bz2") returned 4 [0053.289] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.289] lstrlenW (lpString=".7z") returned 3 [0053.289] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.289] lstrlenW (lpString=".dbf") returned 4 [0053.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.289] lstrlenW (lpString=".1cd") returned 4 [0053.289] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.289] lstrlenW (lpString=".jpg") returned 4 [0053.289] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.290] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.290] lstrlenW (lpString="Proof.xml") returned 9 [0053.290] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0053.494] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1347) returned 1 [0053.494] CloseHandle (hObject=0x16c) returned 1 [0053.494] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0053.494] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.494] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0053.495] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.495] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.495] GetLastError () returned 0x0 [0053.495] ReadFile (in: hFile=0x16c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x543, lpOverlapped=0x0) returned 1 [0053.609] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x550, lpOverlapped=0x0) returned 1 [0053.610] ReadFile (in: hFile=0x16c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.611] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.611] SetEndOfFile (hFile=0x160) returned 1 [0053.611] CloseHandle (hObject=0x160) returned 1 [0053.612] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.612] SetEndOfFile (hFile=0x16c) returned 1 [0053.613] CloseHandle (hObject=0x16c) returned 1 [0053.613] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0053.613] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0053.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.613] lstrlenW (lpString=".doc") returned 4 [0053.613] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.613] lstrlenW (lpString=".docx") returned 5 [0053.613] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0053.614] lstrlenW (lpString=".pdf") returned 4 [0053.614] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.614] lstrlenW (lpString=".xls") returned 4 [0053.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.614] lstrlenW (lpString=".xlsx") returned 5 [0053.614] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0053.614] lstrlenW (lpString=".ppt") returned 4 [0053.614] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.614] lstrlenW (lpString=".zip") returned 4 [0053.614] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.614] lstrlenW (lpString=".rar") returned 4 [0053.614] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.614] lstrlenW (lpString=".bz2") returned 4 [0053.614] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.614] lstrlenW (lpString=".7z") returned 3 [0053.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.614] lstrlenW (lpString=".dbf") returned 4 [0053.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.614] lstrlenW (lpString=".1cd") returned 4 [0053.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.614] lstrlenW (lpString=".jpg") returned 4 [0053.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.647] lstrlenW (lpString=".doc") returned 4 [0053.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.647] lstrlenW (lpString=".docx") returned 5 [0053.647] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0053.647] lstrlenW (lpString=".pdf") returned 4 [0053.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.647] lstrlenW (lpString=".xls") returned 4 [0053.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.647] lstrlenW (lpString=".xlsx") returned 5 [0053.647] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0053.647] lstrlenW (lpString=".ppt") returned 4 [0053.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.647] lstrlenW (lpString=".zip") returned 4 [0053.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.647] lstrlenW (lpString=".rar") returned 4 [0053.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.647] lstrlenW (lpString=".bz2") returned 4 [0053.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.647] lstrlenW (lpString=".7z") returned 3 [0053.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.648] lstrlenW (lpString=".dbf") returned 4 [0053.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.648] lstrlenW (lpString=".1cd") returned 4 [0053.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0053.648] lstrlenW (lpString=".jpg") returned 4 [0053.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.648] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.648] lstrlenW (lpString="Proofing.xml") returned 12 [0053.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.648] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=811) returned 1 [0053.648] CloseHandle (hObject=0x160) returned 1 [0053.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0053.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.649] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.649] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0053.649] GetLastError () returned 0x0 [0053.649] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x32b, lpOverlapped=0x0) returned 1 [0053.771] WriteFile (in: hFile=0x170, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x330, lpOverlapped=0x0) returned 1 [0053.772] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.772] WriteFile (in: hFile=0x170, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.772] SetEndOfFile (hFile=0x170) returned 1 [0053.772] CloseHandle (hObject=0x170) returned 1 [0053.773] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.773] SetEndOfFile (hFile=0x160) returned 1 [0053.774] CloseHandle (hObject=0x160) returned 1 [0053.774] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0053.775] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0053.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.775] lstrlenW (lpString=".doc") returned 4 [0053.775] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.775] lstrlenW (lpString=".docx") returned 5 [0053.775] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0053.775] lstrlenW (lpString=".pdf") returned 4 [0053.775] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.775] lstrlenW (lpString=".xls") returned 4 [0053.775] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.775] lstrlenW (lpString=".xlsx") returned 5 [0053.775] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0053.775] lstrlenW (lpString=".ppt") returned 4 [0053.775] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.775] lstrlenW (lpString=".zip") returned 4 [0053.775] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.775] lstrlenW (lpString=".rar") returned 4 [0053.775] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString=".bz2") returned 4 [0053.776] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString=".7z") returned 3 [0053.776] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.776] lstrlenW (lpString=".dbf") returned 4 [0053.776] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.776] lstrlenW (lpString=".1cd") returned 4 [0053.776] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.776] lstrlenW (lpString=".jpg") returned 4 [0053.776] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.776] lstrlenW (lpString=".doc") returned 4 [0053.776] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString=".docx") returned 5 [0053.776] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0053.776] lstrlenW (lpString=".pdf") returned 4 [0053.776] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString=".xls") returned 4 [0053.776] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString=".xlsx") returned 5 [0053.776] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0053.776] lstrlenW (lpString=".ppt") returned 4 [0053.776] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.777] lstrlenW (lpString=".zip") returned 4 [0053.777] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.777] lstrlenW (lpString=".rar") returned 4 [0053.777] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.777] lstrlenW (lpString=".bz2") returned 4 [0053.777] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.777] lstrlenW (lpString=".7z") returned 3 [0053.777] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.777] lstrlenW (lpString=".dbf") returned 4 [0053.777] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.777] lstrlenW (lpString=".1cd") returned 4 [0053.777] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0053.777] lstrlenW (lpString=".jpg") returned 4 [0053.777] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.777] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.777] lstrlenW (lpString="Office32MUI.xml") returned 15 [0053.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.778] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1383) returned 1 [0053.778] CloseHandle (hObject=0x160) returned 1 [0053.778] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0053.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.779] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.779] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0053.779] GetLastError () returned 0x0 [0053.779] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x567, lpOverlapped=0x0) returned 1 [0053.995] WriteFile (in: hFile=0x170, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x570, lpOverlapped=0x0) returned 1 [0053.996] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.996] WriteFile (in: hFile=0x170, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf2, lpOverlapped=0x0) returned 1 [0053.997] SetEndOfFile (hFile=0x170) returned 1 [0053.997] CloseHandle (hObject=0x170) returned 1 [0054.000] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.000] SetEndOfFile (hFile=0x160) returned 1 [0054.001] CloseHandle (hObject=0x160) returned 1 [0054.001] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.002] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0054.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.002] lstrlenW (lpString=".doc") returned 4 [0054.002] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.002] lstrlenW (lpString=".docx") returned 5 [0054.002] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.002] lstrlenW (lpString=".pdf") returned 4 [0054.002] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.002] lstrlenW (lpString=".xls") returned 4 [0054.002] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.002] lstrlenW (lpString=".xlsx") returned 5 [0054.002] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.002] lstrlenW (lpString=".ppt") returned 4 [0054.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.003] lstrlenW (lpString=".zip") returned 4 [0054.003] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.003] lstrlenW (lpString=".rar") returned 4 [0054.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString=".bz2") returned 4 [0054.003] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString=".7z") returned 3 [0054.003] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.003] lstrlenW (lpString=".dbf") returned 4 [0054.003] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.003] lstrlenW (lpString=".1cd") returned 4 [0054.003] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.003] lstrlenW (lpString=".jpg") returned 4 [0054.003] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.003] lstrlenW (lpString=".doc") returned 4 [0054.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString=".docx") returned 5 [0054.003] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.003] lstrlenW (lpString=".pdf") returned 4 [0054.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString=".xls") returned 4 [0054.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString=".xlsx") returned 5 [0054.003] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.004] lstrlenW (lpString=".ppt") returned 4 [0054.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.004] lstrlenW (lpString=".zip") returned 4 [0054.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.004] lstrlenW (lpString=".rar") returned 4 [0054.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString=".bz2") returned 4 [0054.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString=".7z") returned 3 [0054.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.004] lstrlenW (lpString=".dbf") returned 4 [0054.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.004] lstrlenW (lpString=".1cd") returned 4 [0054.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0054.004] lstrlenW (lpString=".jpg") returned 4 [0054.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.004] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.004] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0054.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.006] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1231) returned 1 [0054.006] CloseHandle (hObject=0x160) returned 1 [0054.006] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0054.006] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.006] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.006] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.007] GetLastError () returned 0x0 [0054.007] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x4cf, lpOverlapped=0x0) returned 1 [0054.311] WriteFile (in: hFile=0x170, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0054.312] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0054.312] WriteFile (in: hFile=0x170, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf2, lpOverlapped=0x0) returned 1 [0054.312] SetEndOfFile (hFile=0x170) returned 1 [0054.312] CloseHandle (hObject=0x170) returned 1 [0054.316] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.316] SetEndOfFile (hFile=0x160) returned 1 [0054.317] CloseHandle (hObject=0x160) returned 1 [0054.317] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.317] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0054.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.317] lstrlenW (lpString=".doc") returned 4 [0054.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.317] lstrlenW (lpString=".docx") returned 5 [0054.318] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.318] lstrlenW (lpString=".pdf") returned 4 [0054.318] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.318] lstrlenW (lpString=".xls") returned 4 [0054.318] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.318] lstrlenW (lpString=".xlsx") returned 5 [0054.318] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.318] lstrlenW (lpString=".ppt") returned 4 [0054.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.318] lstrlenW (lpString=".zip") returned 4 [0054.318] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.318] lstrlenW (lpString=".rar") returned 4 [0054.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.318] lstrlenW (lpString=".bz2") returned 4 [0054.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.318] lstrlenW (lpString=".7z") returned 3 [0054.318] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.318] lstrlenW (lpString=".dbf") returned 4 [0054.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.318] lstrlenW (lpString=".1cd") returned 4 [0054.318] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.318] lstrlenW (lpString=".jpg") returned 4 [0054.318] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.318] lstrlenW (lpString=".doc") returned 4 [0054.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.319] lstrlenW (lpString=".docx") returned 5 [0054.319] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.319] lstrlenW (lpString=".pdf") returned 4 [0054.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.319] lstrlenW (lpString=".xls") returned 4 [0054.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.319] lstrlenW (lpString=".xlsx") returned 5 [0054.319] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.319] lstrlenW (lpString=".ppt") returned 4 [0054.319] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.319] lstrlenW (lpString=".zip") returned 4 [0054.319] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.319] lstrlenW (lpString=".rar") returned 4 [0054.319] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.319] lstrlenW (lpString=".bz2") returned 4 [0054.319] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.319] lstrlenW (lpString=".7z") returned 3 [0054.319] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.319] lstrlenW (lpString=".dbf") returned 4 [0054.319] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.319] lstrlenW (lpString=".1cd") returned 4 [0054.319] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0054.319] lstrlenW (lpString=".jpg") returned 4 [0054.319] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.320] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.320] lstrlenW (lpString="Setup.xml") returned 9 [0054.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0054.413] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1872) returned 1 [0054.413] CloseHandle (hObject=0x1b4) returned 1 [0054.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0054.413] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.413] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.414] GetLastError () returned 0x0 [0054.414] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x750, lpOverlapped=0x0) returned 1 [0054.543] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x760, lpOverlapped=0x0) returned 1 [0054.544] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0054.544] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.544] SetEndOfFile (hFile=0x160) returned 1 [0054.545] CloseHandle (hObject=0x160) returned 1 [0054.546] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.546] SetEndOfFile (hFile=0x1b4) returned 1 [0054.548] CloseHandle (hObject=0x1b4) returned 1 [0054.548] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.548] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.548] lstrlenW (lpString=".doc") returned 4 [0054.549] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.549] lstrlenW (lpString=".docx") returned 5 [0054.549] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.549] lstrlenW (lpString=".pdf") returned 4 [0054.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.549] lstrlenW (lpString=".xls") returned 4 [0054.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.549] lstrlenW (lpString=".xlsx") returned 5 [0054.549] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.549] lstrlenW (lpString=".ppt") returned 4 [0054.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.549] lstrlenW (lpString=".zip") returned 4 [0054.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.549] lstrlenW (lpString=".rar") returned 4 [0054.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.549] lstrlenW (lpString=".bz2") returned 4 [0054.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.549] lstrlenW (lpString=".7z") returned 3 [0054.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.550] lstrlenW (lpString=".dbf") returned 4 [0054.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.550] lstrlenW (lpString=".1cd") returned 4 [0054.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.550] lstrlenW (lpString=".jpg") returned 4 [0054.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.550] lstrlenW (lpString=".doc") returned 4 [0054.550] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.550] lstrlenW (lpString=".docx") returned 5 [0054.550] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0054.550] lstrlenW (lpString=".pdf") returned 4 [0054.551] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.551] lstrlenW (lpString=".xls") returned 4 [0054.551] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.551] lstrlenW (lpString=".xlsx") returned 5 [0054.551] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0054.551] lstrlenW (lpString=".ppt") returned 4 [0054.551] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.551] lstrlenW (lpString=".zip") returned 4 [0054.551] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.551] lstrlenW (lpString=".rar") returned 4 [0054.551] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.551] lstrlenW (lpString=".bz2") returned 4 [0054.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.552] lstrlenW (lpString=".7z") returned 3 [0054.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.552] lstrlenW (lpString=".dbf") returned 4 [0054.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.552] lstrlenW (lpString=".1cd") returned 4 [0054.552] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0054.552] lstrlenW (lpString=".jpg") returned 4 [0054.552] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.553] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.553] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0054.553] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0054.555] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=913) returned 1 [0054.555] CloseHandle (hObject=0x1b4) returned 1 [0054.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0054.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0054.555] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.555] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.556] GetLastError () returned 0x0 [0054.556] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x391, lpOverlapped=0x0) returned 1 [0054.960] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0054.961] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0054.964] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xee, lpOverlapped=0x0) returned 1 [0054.964] SetEndOfFile (hFile=0x160) returned 1 [0054.966] CloseHandle (hObject=0x160) returned 1 [0054.967] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.967] SetEndOfFile (hFile=0x1b4) returned 1 [0054.968] CloseHandle (hObject=0x1b4) returned 1 [0054.968] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.968] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0054.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.969] lstrlenW (lpString=".doc") returned 4 [0054.969] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.969] lstrlenW (lpString=".docx") returned 5 [0054.969] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.969] lstrlenW (lpString=".pdf") returned 4 [0054.969] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.969] lstrlenW (lpString=".xls") returned 4 [0054.969] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.969] lstrlenW (lpString=".xlsx") returned 5 [0054.969] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.969] lstrlenW (lpString=".ppt") returned 4 [0054.969] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.969] lstrlenW (lpString=".zip") returned 4 [0054.969] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.969] lstrlenW (lpString=".rar") returned 4 [0054.969] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.969] lstrlenW (lpString=".bz2") returned 4 [0054.969] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.969] lstrlenW (lpString=".7z") returned 3 [0054.969] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.969] lstrlenW (lpString=".dbf") returned 4 [0054.969] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.969] lstrlenW (lpString=".1cd") returned 4 [0054.969] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.969] lstrlenW (lpString=".jpg") returned 4 [0054.969] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.970] lstrlenW (lpString=".doc") returned 4 [0054.970] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString=".docx") returned 5 [0054.970] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.970] lstrlenW (lpString=".pdf") returned 4 [0054.970] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString=".xls") returned 4 [0054.970] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString=".xlsx") returned 5 [0054.970] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.970] lstrlenW (lpString=".ppt") returned 4 [0054.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.970] lstrlenW (lpString=".zip") returned 4 [0054.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.970] lstrlenW (lpString=".rar") returned 4 [0054.970] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString=".bz2") returned 4 [0054.970] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString=".7z") returned 3 [0054.970] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.970] lstrlenW (lpString=".dbf") returned 4 [0054.970] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.970] lstrlenW (lpString=".1cd") returned 4 [0054.970] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0054.971] lstrlenW (lpString=".jpg") returned 4 [0054.971] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.971] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.971] lstrlenW (lpString="branding.xml") returned 12 [0054.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0054.975] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=596341) returned 1 [0054.975] CloseHandle (hObject=0x1b4) returned 1 [0054.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0054.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0054.975] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.975] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.976] GetLastError () returned 0x0 [0054.976] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x91975, lpOverlapped=0x0) returned 1 [0055.034] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x91980, lpOverlapped=0x0) returned 1 [0055.045] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0055.046] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.046] SetEndOfFile (hFile=0x160) returned 1 [0055.046] CloseHandle (hObject=0x160) returned 1 [0055.879] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.879] SetEndOfFile (hFile=0x1b4) returned 1 [0055.885] CloseHandle (hObject=0x1b4) returned 1 [0055.885] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.885] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0055.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.885] lstrlenW (lpString=".doc") returned 4 [0055.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.886] lstrlenW (lpString=".docx") returned 5 [0055.886] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0055.886] lstrlenW (lpString=".pdf") returned 4 [0055.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.886] lstrlenW (lpString=".xls") returned 4 [0055.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.886] lstrlenW (lpString=".xlsx") returned 5 [0055.886] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0055.886] lstrlenW (lpString=".ppt") returned 4 [0055.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.886] lstrlenW (lpString=".zip") returned 4 [0055.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.886] lstrlenW (lpString=".rar") returned 4 [0055.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.886] lstrlenW (lpString=".bz2") returned 4 [0055.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.886] lstrlenW (lpString=".7z") returned 3 [0055.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.886] lstrlenW (lpString=".dbf") returned 4 [0055.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.886] lstrlenW (lpString=".1cd") returned 4 [0055.886] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.886] lstrlenW (lpString=".jpg") returned 4 [0055.886] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.887] lstrlenW (lpString=".doc") returned 4 [0055.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString=".docx") returned 5 [0055.887] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0055.887] lstrlenW (lpString=".pdf") returned 4 [0055.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString=".xls") returned 4 [0055.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString=".xlsx") returned 5 [0055.887] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0055.887] lstrlenW (lpString=".ppt") returned 4 [0055.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.887] lstrlenW (lpString=".zip") returned 4 [0055.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.887] lstrlenW (lpString=".rar") returned 4 [0055.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString=".bz2") returned 4 [0055.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString=".7z") returned 3 [0055.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.887] lstrlenW (lpString=".dbf") returned 4 [0055.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.887] lstrlenW (lpString=".1cd") returned 4 [0055.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0055.888] lstrlenW (lpString=".jpg") returned 4 [0055.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.888] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.888] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0055.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0055.893] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=16852) returned 1 [0055.893] CloseHandle (hObject=0x1b4) returned 1 [0055.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0055.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0055.893] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.894] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.895] GetLastError () returned 0x0 [0055.895] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x41d4, lpOverlapped=0x0) returned 1 [0056.060] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0056.061] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0056.061] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf0, lpOverlapped=0x0) returned 1 [0056.061] SetEndOfFile (hFile=0x160) returned 1 [0056.061] CloseHandle (hObject=0x160) returned 1 [0056.064] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.064] SetEndOfFile (hFile=0x1b4) returned 1 [0056.065] CloseHandle (hObject=0x1b4) returned 1 [0056.065] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.065] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0056.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.066] lstrlenW (lpString=".doc") returned 4 [0056.066] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.066] lstrlenW (lpString=".docx") returned 5 [0056.066] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.066] lstrlenW (lpString=".pdf") returned 4 [0056.066] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.066] lstrlenW (lpString=".xls") returned 4 [0056.066] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.066] lstrlenW (lpString=".xlsx") returned 5 [0056.066] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.066] lstrlenW (lpString=".ppt") returned 4 [0056.066] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.066] lstrlenW (lpString=".zip") returned 4 [0056.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.066] lstrlenW (lpString=".rar") returned 4 [0056.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.066] lstrlenW (lpString=".bz2") returned 4 [0056.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.066] lstrlenW (lpString=".7z") returned 3 [0056.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.066] lstrlenW (lpString=".dbf") returned 4 [0056.067] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.067] lstrlenW (lpString=".1cd") returned 4 [0056.067] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.067] lstrlenW (lpString=".jpg") returned 4 [0056.067] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.067] lstrlenW (lpString=".doc") returned 4 [0056.067] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString=".docx") returned 5 [0056.067] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.067] lstrlenW (lpString=".pdf") returned 4 [0056.067] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString=".xls") returned 4 [0056.067] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString=".xlsx") returned 5 [0056.067] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.067] lstrlenW (lpString=".ppt") returned 4 [0056.067] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.067] lstrlenW (lpString=".zip") returned 4 [0056.067] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.067] lstrlenW (lpString=".rar") returned 4 [0056.067] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString=".bz2") returned 4 [0056.067] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.067] lstrlenW (lpString=".7z") returned 3 [0056.068] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.068] lstrlenW (lpString=".dbf") returned 4 [0056.068] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.068] lstrlenW (lpString=".1cd") returned 4 [0056.068] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0056.068] lstrlenW (lpString=".jpg") returned 4 [0056.068] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.068] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.068] lstrlenW (lpString="Office32WW.xml") returned 14 [0056.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.069] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=4274) returned 1 [0056.069] CloseHandle (hObject=0x1b4) returned 1 [0056.069] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0056.069] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.069] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.070] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.070] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.070] GetLastError () returned 0x0 [0056.070] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x10b2, lpOverlapped=0x0) returned 1 [0056.273] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0056.274] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0056.274] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf0, lpOverlapped=0x0) returned 1 [0056.274] SetEndOfFile (hFile=0x160) returned 1 [0056.274] CloseHandle (hObject=0x160) returned 1 [0056.275] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.275] SetEndOfFile (hFile=0x1b4) returned 1 [0056.276] CloseHandle (hObject=0x1b4) returned 1 [0056.276] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.276] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0056.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.276] lstrlenW (lpString=".doc") returned 4 [0056.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.276] lstrlenW (lpString=".docx") returned 5 [0056.276] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.276] lstrlenW (lpString=".pdf") returned 4 [0056.276] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.276] lstrlenW (lpString=".xls") returned 4 [0056.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.276] lstrlenW (lpString=".xlsx") returned 5 [0056.276] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.277] lstrlenW (lpString=".ppt") returned 4 [0056.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.277] lstrlenW (lpString=".zip") returned 4 [0056.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.277] lstrlenW (lpString=".rar") returned 4 [0056.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString=".bz2") returned 4 [0056.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString=".7z") returned 3 [0056.277] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.277] lstrlenW (lpString=".dbf") returned 4 [0056.277] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.277] lstrlenW (lpString=".1cd") returned 4 [0056.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.277] lstrlenW (lpString=".jpg") returned 4 [0056.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.277] lstrlenW (lpString=".doc") returned 4 [0056.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString=".docx") returned 5 [0056.277] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.277] lstrlenW (lpString=".pdf") returned 4 [0056.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString=".xls") returned 4 [0056.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString=".xlsx") returned 5 [0056.277] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.278] lstrlenW (lpString=".ppt") returned 4 [0056.278] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.278] lstrlenW (lpString=".zip") returned 4 [0056.278] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.278] lstrlenW (lpString=".rar") returned 4 [0056.278] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString=".bz2") returned 4 [0056.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString=".7z") returned 3 [0056.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.278] lstrlenW (lpString=".dbf") returned 4 [0056.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.278] lstrlenW (lpString=".1cd") returned 4 [0056.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0056.278] lstrlenW (lpString=".jpg") returned 4 [0056.278] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.278] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.278] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0056.278] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.288] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=6421) returned 1 [0056.288] CloseHandle (hObject=0x1b4) returned 1 [0056.288] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0056.288] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.288] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.288] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.288] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.288] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.289] GetLastError () returned 0x0 [0056.289] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x1915, lpOverlapped=0x0) returned 1 [0056.550] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x1920, lpOverlapped=0x0) returned 1 [0056.551] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0056.551] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xee, lpOverlapped=0x0) returned 1 [0056.551] SetEndOfFile (hFile=0x160) returned 1 [0056.551] CloseHandle (hObject=0x160) returned 1 [0056.552] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.552] SetEndOfFile (hFile=0x1b4) returned 1 [0056.553] CloseHandle (hObject=0x1b4) returned 1 [0056.553] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.553] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0056.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.554] lstrlenW (lpString=".doc") returned 4 [0056.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.554] lstrlenW (lpString=".docx") returned 5 [0056.554] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.554] lstrlenW (lpString=".pdf") returned 4 [0056.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.554] lstrlenW (lpString=".xls") returned 4 [0056.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.554] lstrlenW (lpString=".xlsx") returned 5 [0056.554] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.554] lstrlenW (lpString=".ppt") returned 4 [0056.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.554] lstrlenW (lpString=".zip") returned 4 [0056.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.554] lstrlenW (lpString=".rar") returned 4 [0056.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.554] lstrlenW (lpString=".bz2") returned 4 [0056.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.554] lstrlenW (lpString=".7z") returned 3 [0056.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.555] lstrlenW (lpString=".dbf") returned 4 [0056.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.555] lstrlenW (lpString=".1cd") returned 4 [0056.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.555] lstrlenW (lpString=".jpg") returned 4 [0056.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.555] lstrlenW (lpString=".doc") returned 4 [0056.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.555] lstrlenW (lpString=".docx") returned 5 [0056.555] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.555] lstrlenW (lpString=".pdf") returned 4 [0056.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.555] lstrlenW (lpString=".xls") returned 4 [0056.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.555] lstrlenW (lpString=".xlsx") returned 5 [0056.555] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.555] lstrlenW (lpString=".ppt") returned 4 [0056.556] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.556] lstrlenW (lpString=".zip") returned 4 [0056.556] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.556] lstrlenW (lpString=".rar") returned 4 [0056.556] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.556] lstrlenW (lpString=".bz2") returned 4 [0056.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.556] lstrlenW (lpString=".7z") returned 3 [0056.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.556] lstrlenW (lpString=".dbf") returned 4 [0056.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.556] lstrlenW (lpString=".1cd") returned 4 [0056.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0056.556] lstrlenW (lpString=".jpg") returned 4 [0056.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.556] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0056.556] lstrlenW (lpString="VisiorWW.xml") returned 12 [0056.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.561] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=8723) returned 1 [0056.561] CloseHandle (hObject=0x1b4) returned 1 [0056.561] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0056.561] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0056.561] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.561] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.562] GetLastError () returned 0x0 [0056.562] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x2213, lpOverlapped=0x0) returned 1 [0056.649] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x2220, lpOverlapped=0x0) returned 1 [0056.650] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0056.650] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.651] SetEndOfFile (hFile=0x160) returned 1 [0056.651] CloseHandle (hObject=0x160) returned 1 [0056.656] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.656] SetEndOfFile (hFile=0x1b4) returned 1 [0056.657] CloseHandle (hObject=0x1b4) returned 1 [0056.657] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0056.657] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0056.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.658] lstrlenW (lpString=".doc") returned 4 [0056.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString=".docx") returned 5 [0056.658] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.658] lstrlenW (lpString=".pdf") returned 4 [0056.658] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString=".xls") returned 4 [0056.658] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString=".xlsx") returned 5 [0056.658] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.658] lstrlenW (lpString=".ppt") returned 4 [0056.658] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.658] lstrlenW (lpString=".zip") returned 4 [0056.658] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.658] lstrlenW (lpString=".rar") returned 4 [0056.658] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString=".bz2") returned 4 [0056.658] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString=".7z") returned 3 [0056.658] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.658] lstrlenW (lpString=".dbf") returned 4 [0056.658] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.658] lstrlenW (lpString=".1cd") returned 4 [0056.658] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.658] lstrlenW (lpString=".jpg") returned 4 [0056.658] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.659] lstrlenW (lpString=".doc") returned 4 [0056.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.659] lstrlenW (lpString=".docx") returned 5 [0056.659] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0056.659] lstrlenW (lpString=".pdf") returned 4 [0056.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.659] lstrlenW (lpString=".xls") returned 4 [0056.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.659] lstrlenW (lpString=".xlsx") returned 5 [0056.659] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0056.659] lstrlenW (lpString=".ppt") returned 4 [0056.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.659] lstrlenW (lpString=".zip") returned 4 [0056.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.659] lstrlenW (lpString=".rar") returned 4 [0056.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.659] lstrlenW (lpString=".bz2") returned 4 [0056.659] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.659] lstrlenW (lpString=".7z") returned 3 [0056.659] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.659] lstrlenW (lpString=".dbf") returned 4 [0056.659] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.659] lstrlenW (lpString=".1cd") returned 4 [0056.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0056.659] lstrlenW (lpString=".jpg") returned 4 [0056.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.660] lstrcmpiW (lpString1=".GIF", lpString2=".beets") returned 1 [0056.660] lstrlenW (lpString="MS.GIF") returned 6 [0056.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0056.679] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1069) returned 1 [0056.679] CloseHandle (hObject=0x170) returned 1 [0056.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0056.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0056.679] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.679] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0056.680] GetLastError () returned 0x0 [0056.680] ReadFile (in: hFile=0x170, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x42d, lpOverlapped=0x0) returned 1 [0056.842] WriteFile (in: hFile=0x16c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x430, lpOverlapped=0x0) returned 1 [0056.843] ReadFile (in: hFile=0x170, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0056.843] WriteFile (in: hFile=0x16c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe0, lpOverlapped=0x0) returned 1 [0056.843] SetEndOfFile (hFile=0x16c) returned 1 [0056.843] CloseHandle (hObject=0x16c) returned 1 [0056.844] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.844] SetEndOfFile (hFile=0x170) returned 1 [0056.845] CloseHandle (hObject=0x170) returned 1 [0056.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0056.845] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0056.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.845] lstrlenW (lpString=".doc") returned 4 [0056.845] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.846] lstrlenW (lpString=".docx") returned 5 [0056.846] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0056.846] lstrlenW (lpString=".pdf") returned 4 [0056.846] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.846] lstrlenW (lpString=".xls") returned 4 [0056.846] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.846] lstrlenW (lpString=".xlsx") returned 5 [0056.846] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0056.846] lstrlenW (lpString=".ppt") returned 4 [0056.846] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.846] lstrlenW (lpString=".zip") returned 4 [0056.846] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.846] lstrlenW (lpString=".rar") returned 4 [0056.846] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.846] lstrlenW (lpString=".bz2") returned 4 [0056.846] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.846] lstrlenW (lpString=".7z") returned 3 [0056.846] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.846] lstrlenW (lpString=".dbf") returned 4 [0056.846] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.846] lstrlenW (lpString=".1cd") returned 4 [0056.846] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.846] lstrlenW (lpString=".jpg") returned 4 [0056.846] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.847] lstrlenW (lpString=".doc") returned 4 [0056.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.847] lstrlenW (lpString=".docx") returned 5 [0056.847] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0056.847] lstrlenW (lpString=".pdf") returned 4 [0056.847] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.847] lstrlenW (lpString=".xls") returned 4 [0056.847] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.847] lstrlenW (lpString=".xlsx") returned 5 [0056.847] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0056.847] lstrlenW (lpString=".ppt") returned 4 [0056.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.849] lstrlenW (lpString=".zip") returned 4 [0056.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.849] lstrlenW (lpString=".rar") returned 4 [0056.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.849] lstrlenW (lpString=".bz2") returned 4 [0056.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.849] lstrlenW (lpString=".7z") returned 3 [0056.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.849] lstrlenW (lpString=".dbf") returned 4 [0056.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.849] lstrlenW (lpString=".1cd") returned 4 [0056.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0056.849] lstrlenW (lpString=".jpg") returned 4 [0056.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.850] lstrcmpiW (lpString1=".PNG", lpString2=".beets") returned 1 [0056.850] lstrlenW (lpString="MS.PNG") returned 6 [0056.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0056.850] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1682) returned 1 [0056.850] CloseHandle (hObject=0x170) returned 1 [0056.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0056.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0056.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0056.850] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.851] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0056.851] GetLastError () returned 0x0 [0056.851] ReadFile (in: hFile=0x170, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x692, lpOverlapped=0x0) returned 1 [0057.244] WriteFile (in: hFile=0x16c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0057.245] ReadFile (in: hFile=0x170, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0057.245] WriteFile (in: hFile=0x16c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe0, lpOverlapped=0x0) returned 1 [0057.245] SetEndOfFile (hFile=0x16c) returned 1 [0057.245] CloseHandle (hObject=0x16c) returned 1 [0057.246] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.246] SetEndOfFile (hFile=0x170) returned 1 [0057.247] CloseHandle (hObject=0x170) returned 1 [0057.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0057.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0057.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.247] lstrlenW (lpString=".doc") returned 4 [0057.247] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.247] lstrlenW (lpString=".docx") returned 5 [0057.247] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0057.248] lstrlenW (lpString=".pdf") returned 4 [0057.248] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.248] lstrlenW (lpString=".xls") returned 4 [0057.248] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.248] lstrlenW (lpString=".xlsx") returned 5 [0057.248] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0057.248] lstrlenW (lpString=".ppt") returned 4 [0057.248] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.248] lstrlenW (lpString=".zip") returned 4 [0057.248] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.248] lstrlenW (lpString=".rar") returned 4 [0057.248] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.248] lstrlenW (lpString=".bz2") returned 4 [0057.248] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.248] lstrlenW (lpString=".7z") returned 3 [0057.248] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.248] lstrlenW (lpString=".dbf") returned 4 [0057.248] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.248] lstrlenW (lpString=".1cd") returned 4 [0057.249] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.249] lstrlenW (lpString=".jpg") returned 4 [0057.249] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.249] lstrlenW (lpString=".doc") returned 4 [0057.249] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.249] lstrlenW (lpString=".docx") returned 5 [0057.249] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0057.249] lstrlenW (lpString=".pdf") returned 4 [0057.249] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.249] lstrlenW (lpString=".xls") returned 4 [0057.249] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.249] lstrlenW (lpString=".xlsx") returned 5 [0057.249] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0057.249] lstrlenW (lpString=".ppt") returned 4 [0057.249] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.249] lstrlenW (lpString=".zip") returned 4 [0057.249] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.249] lstrlenW (lpString=".rar") returned 4 [0057.249] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.249] lstrlenW (lpString=".bz2") returned 4 [0057.249] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.249] lstrlenW (lpString=".7z") returned 3 [0057.250] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.250] lstrlenW (lpString=".dbf") returned 4 [0057.250] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.250] lstrlenW (lpString=".1cd") returned 4 [0057.250] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0057.250] lstrlenW (lpString=".jpg") returned 4 [0057.250] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.250] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0057.250] lstrlenW (lpString="boxed-delete.avi") returned 16 [0057.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.232] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=31744) returned 1 [0059.232] CloseHandle (hObject=0x1a4) returned 1 [0059.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0059.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.233] lstrlenW (lpString=".doc") returned 4 [0059.233] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.233] lstrlenW (lpString=".docx") returned 5 [0059.233] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0059.233] lstrlenW (lpString=".pdf") returned 4 [0059.233] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.233] lstrlenW (lpString=".xls") returned 4 [0059.233] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.233] lstrlenW (lpString=".xlsx") returned 5 [0059.233] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0059.233] lstrlenW (lpString=".ppt") returned 4 [0059.233] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.233] lstrlenW (lpString=".zip") returned 4 [0059.233] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.233] lstrlenW (lpString=".rar") returned 4 [0059.233] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.233] lstrlenW (lpString=".bz2") returned 4 [0059.234] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.234] lstrlenW (lpString=".7z") returned 3 [0059.234] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.234] lstrlenW (lpString=".dbf") returned 4 [0059.234] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.234] lstrlenW (lpString=".1cd") returned 4 [0059.234] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.234] lstrlenW (lpString=".jpg") returned 4 [0059.234] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.234] lstrlenW (lpString=".doc") returned 4 [0059.234] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.234] lstrlenW (lpString=".docx") returned 5 [0059.234] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0059.234] lstrlenW (lpString=".pdf") returned 4 [0059.234] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.234] lstrlenW (lpString=".xls") returned 4 [0059.234] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.234] lstrlenW (lpString=".xlsx") returned 5 [0059.234] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0059.234] lstrlenW (lpString=".ppt") returned 4 [0059.234] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.234] lstrlenW (lpString=".zip") returned 4 [0059.234] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.235] lstrlenW (lpString=".rar") returned 4 [0059.235] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.235] lstrlenW (lpString=".bz2") returned 4 [0059.235] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.235] lstrlenW (lpString=".7z") returned 3 [0059.235] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.235] lstrlenW (lpString=".dbf") returned 4 [0059.235] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.235] lstrlenW (lpString=".1cd") returned 4 [0059.235] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0059.235] lstrlenW (lpString=".jpg") returned 4 [0059.235] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.235] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0059.235] lstrlenW (lpString="join.avi") returned 8 [0059.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.236] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=222208) returned 1 [0059.236] CloseHandle (hObject=0x1a4) returned 1 [0059.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0059.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.236] lstrlenW (lpString=".doc") returned 4 [0059.236] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.236] lstrlenW (lpString=".docx") returned 5 [0059.236] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0059.236] lstrlenW (lpString=".pdf") returned 4 [0059.236] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.236] lstrlenW (lpString=".xls") returned 4 [0059.236] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.236] lstrlenW (lpString=".xlsx") returned 5 [0059.236] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0059.236] lstrlenW (lpString=".ppt") returned 4 [0059.236] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.236] lstrlenW (lpString=".zip") returned 4 [0059.237] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.237] lstrlenW (lpString=".rar") returned 4 [0059.237] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.237] lstrlenW (lpString=".bz2") returned 4 [0059.237] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.237] lstrlenW (lpString=".7z") returned 3 [0059.237] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.237] lstrlenW (lpString=".dbf") returned 4 [0059.237] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.237] lstrlenW (lpString=".1cd") returned 4 [0059.237] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.237] lstrlenW (lpString=".jpg") returned 4 [0059.237] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.237] lstrlenW (lpString=".doc") returned 4 [0059.237] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.237] lstrlenW (lpString=".docx") returned 5 [0059.237] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0059.237] lstrlenW (lpString=".pdf") returned 4 [0059.237] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.237] lstrlenW (lpString=".xls") returned 4 [0059.237] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.237] lstrlenW (lpString=".xlsx") returned 5 [0059.237] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0059.237] lstrlenW (lpString=".ppt") returned 4 [0059.238] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.238] lstrlenW (lpString=".zip") returned 4 [0059.238] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.238] lstrlenW (lpString=".rar") returned 4 [0059.238] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.238] lstrlenW (lpString=".bz2") returned 4 [0059.238] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.238] lstrlenW (lpString=".7z") returned 3 [0059.238] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.238] lstrlenW (lpString=".dbf") returned 4 [0059.238] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.238] lstrlenW (lpString=".1cd") returned 4 [0059.238] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0059.238] lstrlenW (lpString=".jpg") returned 4 [0059.238] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.238] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0059.238] lstrlenW (lpString="split.avi") returned 9 [0059.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.239] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=194048) returned 1 [0059.239] CloseHandle (hObject=0x1a4) returned 1 [0059.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0059.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.239] lstrlenW (lpString=".doc") returned 4 [0059.239] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.239] lstrlenW (lpString=".docx") returned 5 [0059.239] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0059.239] lstrlenW (lpString=".pdf") returned 4 [0059.240] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.240] lstrlenW (lpString=".xls") returned 4 [0059.240] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.240] lstrlenW (lpString=".xlsx") returned 5 [0059.240] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0059.240] lstrlenW (lpString=".ppt") returned 4 [0059.240] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.240] lstrlenW (lpString=".zip") returned 4 [0059.240] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.240] lstrlenW (lpString=".rar") returned 4 [0059.240] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.240] lstrlenW (lpString=".bz2") returned 4 [0059.240] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.240] lstrlenW (lpString=".7z") returned 3 [0059.240] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.240] lstrlenW (lpString=".dbf") returned 4 [0059.240] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.240] lstrlenW (lpString=".1cd") returned 4 [0059.240] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.241] lstrlenW (lpString=".jpg") returned 4 [0059.241] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.241] lstrlenW (lpString=".doc") returned 4 [0059.241] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.241] lstrlenW (lpString=".docx") returned 5 [0059.241] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0059.241] lstrlenW (lpString=".pdf") returned 4 [0059.241] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.241] lstrlenW (lpString=".xls") returned 4 [0059.241] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.241] lstrlenW (lpString=".xlsx") returned 5 [0059.241] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0059.241] lstrlenW (lpString=".ppt") returned 4 [0059.241] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.241] lstrlenW (lpString=".zip") returned 4 [0059.241] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.241] lstrlenW (lpString=".rar") returned 4 [0059.241] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.241] lstrlenW (lpString=".bz2") returned 4 [0059.241] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.241] lstrlenW (lpString=".7z") returned 3 [0059.241] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.242] lstrlenW (lpString=".dbf") returned 4 [0059.242] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.242] lstrlenW (lpString=".1cd") returned 4 [0059.242] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0059.242] lstrlenW (lpString=".jpg") returned 4 [0059.242] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.242] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0059.242] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0059.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.242] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1600388) returned 1 [0059.242] CloseHandle (hObject=0x1a4) returned 1 [0059.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0059.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0059.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.243] lstrlenW (lpString=".doc") returned 4 [0059.243] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.243] lstrlenW (lpString=".docx") returned 5 [0059.243] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0059.243] lstrlenW (lpString=".pdf") returned 4 [0059.243] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.243] lstrlenW (lpString=".xls") returned 4 [0059.243] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.243] lstrlenW (lpString=".xlsx") returned 5 [0059.243] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0059.243] lstrlenW (lpString=".ppt") returned 4 [0059.243] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.243] lstrlenW (lpString=".zip") returned 4 [0059.243] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.243] lstrlenW (lpString=".rar") returned 4 [0059.244] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.244] lstrlenW (lpString=".bz2") returned 4 [0059.244] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.244] lstrlenW (lpString=".7z") returned 3 [0059.244] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.244] lstrlenW (lpString=".dbf") returned 4 [0059.244] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.244] lstrlenW (lpString=".1cd") returned 4 [0059.244] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.244] lstrlenW (lpString=".jpg") returned 4 [0059.244] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.244] lstrlenW (lpString=".doc") returned 4 [0059.244] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.244] lstrlenW (lpString=".docx") returned 5 [0059.244] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0059.244] lstrlenW (lpString=".pdf") returned 4 [0059.244] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.244] lstrlenW (lpString=".xls") returned 4 [0059.244] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.244] lstrlenW (lpString=".xlsx") returned 5 [0059.244] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0059.244] lstrlenW (lpString=".ppt") returned 4 [0059.244] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.245] lstrlenW (lpString=".zip") returned 4 [0059.245] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.245] lstrlenW (lpString=".rar") returned 4 [0059.245] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.245] lstrlenW (lpString=".bz2") returned 4 [0059.245] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.245] lstrlenW (lpString=".7z") returned 3 [0059.245] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.245] lstrlenW (lpString=".dbf") returned 4 [0059.245] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.245] lstrlenW (lpString=".1cd") returned 4 [0059.245] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0059.245] lstrlenW (lpString=".jpg") returned 4 [0059.245] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.245] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.245] lstrlenW (lpString="auxbase.xml") returned 11 [0059.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.362] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1434) returned 1 [0059.362] CloseHandle (hObject=0x1a4) returned 1 [0059.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0059.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.362] lstrlenW (lpString=".doc") returned 4 [0059.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.362] lstrlenW (lpString=".docx") returned 5 [0059.362] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0059.362] lstrlenW (lpString=".pdf") returned 4 [0059.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.362] lstrlenW (lpString=".xls") returned 4 [0059.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.362] lstrlenW (lpString=".xlsx") returned 5 [0059.362] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0059.363] lstrlenW (lpString=".ppt") returned 4 [0059.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.363] lstrlenW (lpString=".zip") returned 4 [0059.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.363] lstrlenW (lpString=".rar") returned 4 [0059.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString=".bz2") returned 4 [0059.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString=".7z") returned 3 [0059.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.363] lstrlenW (lpString=".dbf") returned 4 [0059.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.363] lstrlenW (lpString=".1cd") returned 4 [0059.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.363] lstrlenW (lpString=".jpg") returned 4 [0059.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.363] lstrlenW (lpString=".doc") returned 4 [0059.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString=".docx") returned 5 [0059.363] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0059.363] lstrlenW (lpString=".pdf") returned 4 [0059.363] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString=".xls") returned 4 [0059.363] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.363] lstrlenW (lpString=".xlsx") returned 5 [0059.364] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0059.364] lstrlenW (lpString=".ppt") returned 4 [0059.364] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.364] lstrlenW (lpString=".zip") returned 4 [0059.364] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.364] lstrlenW (lpString=".rar") returned 4 [0059.364] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.364] lstrlenW (lpString=".bz2") returned 4 [0059.364] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.364] lstrlenW (lpString=".7z") returned 3 [0059.364] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.364] lstrlenW (lpString=".dbf") returned 4 [0059.364] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.364] lstrlenW (lpString=".1cd") returned 4 [0059.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0059.364] lstrlenW (lpString=".jpg") returned 4 [0059.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.364] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.364] lstrlenW (lpString="kor-kor.xml") returned 11 [0059.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.498] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=392) returned 1 [0059.498] CloseHandle (hObject=0x1a4) returned 1 [0059.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0059.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.498] lstrlenW (lpString=".doc") returned 4 [0059.499] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.499] lstrlenW (lpString=".docx") returned 5 [0059.499] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0059.499] lstrlenW (lpString=".pdf") returned 4 [0059.499] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.499] lstrlenW (lpString=".xls") returned 4 [0059.499] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.499] lstrlenW (lpString=".xlsx") returned 5 [0059.499] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0059.499] lstrlenW (lpString=".ppt") returned 4 [0059.499] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.499] lstrlenW (lpString=".zip") returned 4 [0059.499] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.499] lstrlenW (lpString=".rar") returned 4 [0059.499] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.499] lstrlenW (lpString=".bz2") returned 4 [0059.499] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.499] lstrlenW (lpString=".7z") returned 3 [0059.499] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.499] lstrlenW (lpString=".dbf") returned 4 [0059.500] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.500] lstrlenW (lpString=".1cd") returned 4 [0059.500] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.500] lstrlenW (lpString=".jpg") returned 4 [0059.500] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.500] lstrlenW (lpString=".doc") returned 4 [0059.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.500] lstrlenW (lpString=".docx") returned 5 [0059.500] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0059.500] lstrlenW (lpString=".pdf") returned 4 [0059.501] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.501] lstrlenW (lpString=".xls") returned 4 [0059.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.501] lstrlenW (lpString=".xlsx") returned 5 [0059.501] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0059.501] lstrlenW (lpString=".ppt") returned 4 [0059.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.501] lstrlenW (lpString=".zip") returned 4 [0059.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.501] lstrlenW (lpString=".rar") returned 4 [0059.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.501] lstrlenW (lpString=".bz2") returned 4 [0059.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.501] lstrlenW (lpString=".7z") returned 3 [0059.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.501] lstrlenW (lpString=".dbf") returned 4 [0059.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.501] lstrlenW (lpString=".1cd") returned 4 [0059.501] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0059.501] lstrlenW (lpString=".jpg") returned 4 [0059.501] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.501] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.502] lstrlenW (lpString="keypad.xml") returned 10 [0059.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.902] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=727) returned 1 [0059.902] CloseHandle (hObject=0x190) returned 1 [0059.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0059.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0059.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0059.903] lstrlenW (lpString=".doc") returned 4 [0059.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.903] lstrlenW (lpString=".docx") returned 5 [0059.903] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0059.903] lstrlenW (lpString=".pdf") returned 4 [0059.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.903] lstrlenW (lpString=".xls") returned 4 [0059.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.903] lstrlenW (lpString=".xlsx") returned 5 [0059.903] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0059.903] lstrlenW (lpString=".ppt") returned 4 [0059.903] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0059.903] lstrlenW (lpString=".zip") returned 4 [0059.903] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.903] lstrlenW (lpString=".rar") returned 4 [0059.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.903] lstrlenW (lpString=".bz2") returned 4 [0059.903] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.903] lstrlenW (lpString=".7z") returned 3 [0059.903] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0059.903] lstrlenW (lpString=".dbf") returned 4 [0059.903] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0061.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0061.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0061.684] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0061.684] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0061.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.684] GetLastError () returned 0x0 [0061.684] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x333, lpOverlapped=0x0) returned 1 [0061.946] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x340, lpOverlapped=0x0) returned 1 [0061.947] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0061.947] WriteFile (in: hFile=0x160, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf4, lpOverlapped=0x0) returned 1 [0061.948] SetEndOfFile (hFile=0x160) returned 1 [0061.948] CloseHandle (hObject=0x160) returned 1 [0061.949] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0061.949] SetEndOfFile (hFile=0x1b4) returned 1 [0061.949] CloseHandle (hObject=0x1b4) returned 1 [0061.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0061.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0061.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.950] lstrlenW (lpString=".doc") returned 4 [0061.950] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.950] lstrlenW (lpString=".docx") returned 5 [0061.950] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0061.950] lstrlenW (lpString=".pdf") returned 4 [0061.950] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.950] lstrlenW (lpString=".xls") returned 4 [0061.950] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.950] lstrlenW (lpString=".xlsx") returned 5 [0061.950] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0061.950] lstrlenW (lpString=".ppt") returned 4 [0061.950] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.950] lstrlenW (lpString=".zip") returned 4 [0061.950] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.950] lstrlenW (lpString=".rar") returned 4 [0061.950] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.950] lstrlenW (lpString=".bz2") returned 4 [0061.950] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.950] lstrlenW (lpString=".7z") returned 3 [0061.950] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.950] lstrlenW (lpString=".dbf") returned 4 [0061.950] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.950] lstrlenW (lpString=".1cd") returned 4 [0061.950] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.950] lstrlenW (lpString=".jpg") returned 4 [0061.950] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.951] lstrlenW (lpString=".doc") returned 4 [0061.951] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString=".docx") returned 5 [0061.951] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0061.951] lstrlenW (lpString=".pdf") returned 4 [0061.951] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString=".xls") returned 4 [0061.951] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString=".xlsx") returned 5 [0061.951] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0061.951] lstrlenW (lpString=".ppt") returned 4 [0061.951] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.951] lstrlenW (lpString=".zip") returned 4 [0061.951] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.951] lstrlenW (lpString=".rar") returned 4 [0061.951] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString=".bz2") returned 4 [0061.951] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString=".7z") returned 3 [0061.951] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.951] lstrlenW (lpString=".dbf") returned 4 [0061.951] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.951] lstrlenW (lpString=".1cd") returned 4 [0061.951] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0061.952] lstrlenW (lpString=".jpg") returned 4 [0061.952] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.952] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0061.952] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0061.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.952] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=913) returned 1 [0061.952] CloseHandle (hObject=0x1b4) returned 1 [0061.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0061.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.953] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0061.953] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0061.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0067.449] GetLastError () returned 0x0 [0067.449] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x391, lpOverlapped=0x0) returned 1 [0067.450] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0067.451] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0067.451] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xee, lpOverlapped=0x0) returned 1 [0067.451] SetEndOfFile (hFile=0x1c4) returned 1 [0067.451] CloseHandle (hObject=0x1c4) returned 1 [0067.452] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0067.452] SetEndOfFile (hFile=0x1b4) returned 1 [0067.457] CloseHandle (hObject=0x1b4) returned 1 [0067.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0067.457] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0067.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.457] lstrlenW (lpString=".doc") returned 4 [0067.457] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.457] lstrlenW (lpString=".docx") returned 5 [0067.457] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0067.457] lstrlenW (lpString=".pdf") returned 4 [0067.457] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.457] lstrlenW (lpString=".xls") returned 4 [0067.458] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString=".xlsx") returned 5 [0067.458] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0067.458] lstrlenW (lpString=".ppt") returned 4 [0067.458] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.458] lstrlenW (lpString=".zip") returned 4 [0067.458] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.458] lstrlenW (lpString=".rar") returned 4 [0067.458] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString=".bz2") returned 4 [0067.458] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString=".7z") returned 3 [0067.458] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.458] lstrlenW (lpString=".dbf") returned 4 [0067.458] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.458] lstrlenW (lpString=".1cd") returned 4 [0067.458] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.458] lstrlenW (lpString=".jpg") returned 4 [0067.458] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.458] lstrlenW (lpString=".doc") returned 4 [0067.458] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString=".docx") returned 5 [0067.458] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0067.458] lstrlenW (lpString=".pdf") returned 4 [0067.458] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString=".xls") returned 4 [0067.458] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.458] lstrlenW (lpString=".xlsx") returned 5 [0067.458] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0067.458] lstrlenW (lpString=".ppt") returned 4 [0067.458] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.459] lstrlenW (lpString=".zip") returned 4 [0067.459] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.459] lstrlenW (lpString=".rar") returned 4 [0067.459] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.459] lstrlenW (lpString=".bz2") returned 4 [0067.459] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.459] lstrlenW (lpString=".7z") returned 3 [0067.459] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.459] lstrlenW (lpString=".dbf") returned 4 [0067.459] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.459] lstrlenW (lpString=".1cd") returned 4 [0067.459] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0067.459] lstrlenW (lpString=".jpg") returned 4 [0067.459] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.459] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0067.459] lstrlenW (lpString="SETUP.XML") returned 9 [0067.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0067.672] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1852) returned 1 [0067.672] CloseHandle (hObject=0x1b4) returned 1 [0067.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0067.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0067.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0067.673] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0067.673] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0067.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0067.673] GetLastError () returned 0x0 [0067.673] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x73c, lpOverlapped=0x0) returned 1 [0067.800] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x740, lpOverlapped=0x0) returned 1 [0067.801] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0067.801] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0067.801] SetEndOfFile (hFile=0x1c4) returned 1 [0067.801] CloseHandle (hObject=0x1c4) returned 1 [0067.808] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0067.809] SetEndOfFile (hFile=0x1b4) returned 1 [0067.809] CloseHandle (hObject=0x1b4) returned 1 [0067.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0067.810] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0067.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.810] lstrlenW (lpString=".doc") returned 4 [0067.810] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.810] lstrlenW (lpString=".docx") returned 5 [0067.810] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0067.810] lstrlenW (lpString=".pdf") returned 4 [0067.810] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.810] lstrlenW (lpString=".xls") returned 4 [0067.810] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.810] lstrlenW (lpString=".xlsx") returned 5 [0067.810] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0067.810] lstrlenW (lpString=".ppt") returned 4 [0067.810] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.810] lstrlenW (lpString=".zip") returned 4 [0067.810] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.810] lstrlenW (lpString=".rar") returned 4 [0067.810] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.810] lstrlenW (lpString=".bz2") returned 4 [0067.810] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.810] lstrlenW (lpString=".7z") returned 3 [0067.810] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.810] lstrlenW (lpString=".dbf") returned 4 [0067.810] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.810] lstrlenW (lpString=".1cd") returned 4 [0067.810] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.810] lstrlenW (lpString=".jpg") returned 4 [0067.811] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.811] lstrlenW (lpString=".doc") returned 4 [0067.811] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.811] lstrlenW (lpString=".docx") returned 5 [0067.811] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0067.811] lstrlenW (lpString=".pdf") returned 4 [0067.811] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.811] lstrlenW (lpString=".xls") returned 4 [0067.811] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.811] lstrlenW (lpString=".xlsx") returned 5 [0067.811] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0067.811] lstrlenW (lpString=".ppt") returned 4 [0067.811] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.811] lstrlenW (lpString=".zip") returned 4 [0067.811] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.811] lstrlenW (lpString=".rar") returned 4 [0067.811] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.811] lstrlenW (lpString=".bz2") returned 4 [0067.811] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.811] lstrlenW (lpString=".7z") returned 3 [0067.811] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.811] lstrlenW (lpString=".dbf") returned 4 [0067.811] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.811] lstrlenW (lpString=".1cd") returned 4 [0067.812] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0067.812] lstrlenW (lpString=".jpg") returned 4 [0067.812] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.812] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0067.812] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0067.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0067.835] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=5557) returned 1 [0067.835] CloseHandle (hObject=0x160) returned 1 [0067.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0067.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0067.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0067.835] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0067.835] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0067.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0067.836] GetLastError () returned 0x0 [0067.836] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x15b5, lpOverlapped=0x0) returned 1 [0068.033] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0068.033] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0068.033] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xee, lpOverlapped=0x0) returned 1 [0068.033] SetEndOfFile (hFile=0x1b4) returned 1 [0068.033] CloseHandle (hObject=0x1b4) returned 1 [0068.034] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0068.034] SetEndOfFile (hFile=0x160) returned 1 [0068.035] CloseHandle (hObject=0x160) returned 1 [0068.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0068.036] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0068.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.036] lstrlenW (lpString=".doc") returned 4 [0068.036] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.036] lstrlenW (lpString=".docx") returned 5 [0068.036] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0068.036] lstrlenW (lpString=".pdf") returned 4 [0068.036] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.036] lstrlenW (lpString=".xls") returned 4 [0068.036] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.036] lstrlenW (lpString=".xlsx") returned 5 [0068.036] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0068.036] lstrlenW (lpString=".ppt") returned 4 [0068.036] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.037] lstrlenW (lpString=".zip") returned 4 [0068.037] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.037] lstrlenW (lpString=".rar") returned 4 [0068.037] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString=".bz2") returned 4 [0068.037] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString=".7z") returned 3 [0068.037] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.037] lstrlenW (lpString=".dbf") returned 4 [0068.037] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.037] lstrlenW (lpString=".1cd") returned 4 [0068.037] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.037] lstrlenW (lpString=".jpg") returned 4 [0068.037] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.037] lstrlenW (lpString=".doc") returned 4 [0068.037] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString=".docx") returned 5 [0068.037] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0068.037] lstrlenW (lpString=".pdf") returned 4 [0068.037] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString=".xls") returned 4 [0068.037] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString=".xlsx") returned 5 [0068.037] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0068.037] lstrlenW (lpString=".ppt") returned 4 [0068.037] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.037] lstrlenW (lpString=".zip") returned 4 [0068.037] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.037] lstrlenW (lpString=".rar") returned 4 [0068.037] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.037] lstrlenW (lpString=".bz2") returned 4 [0068.037] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.038] lstrlenW (lpString=".7z") returned 3 [0068.038] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.038] lstrlenW (lpString=".dbf") returned 4 [0068.038] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.038] lstrlenW (lpString=".1cd") returned 4 [0068.038] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0068.038] lstrlenW (lpString=".jpg") returned 4 [0068.038] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.038] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0068.038] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0068.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0068.038] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=819) returned 1 [0068.038] CloseHandle (hObject=0x160) returned 1 [0068.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0068.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0068.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0068.039] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0068.039] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0068.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0068.041] GetLastError () returned 0x0 [0068.041] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x333, lpOverlapped=0x0) returned 1 [0068.400] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x340, lpOverlapped=0x0) returned 1 [0068.927] ReadFile (in: hFile=0x160, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0068.927] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf4, lpOverlapped=0x0) returned 1 [0068.928] SetEndOfFile (hFile=0x1b4) returned 1 [0068.928] CloseHandle (hObject=0x1b4) returned 1 [0068.929] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0068.929] SetEndOfFile (hFile=0x160) returned 1 [0068.930] CloseHandle (hObject=0x160) returned 1 [0068.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0068.930] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0069.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.730] lstrlenW (lpString=".doc") returned 4 [0069.730] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.730] lstrlenW (lpString=".docx") returned 5 [0069.730] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0069.730] lstrlenW (lpString=".pdf") returned 4 [0069.730] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.730] lstrlenW (lpString=".xls") returned 4 [0069.730] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.730] lstrlenW (lpString=".xlsx") returned 5 [0069.730] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0069.730] lstrlenW (lpString=".ppt") returned 4 [0069.730] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.730] lstrlenW (lpString=".zip") returned 4 [0069.730] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.730] lstrlenW (lpString=".rar") returned 4 [0069.730] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.730] lstrlenW (lpString=".bz2") returned 4 [0069.730] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.730] lstrlenW (lpString=".7z") returned 3 [0069.730] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.730] lstrlenW (lpString=".dbf") returned 4 [0069.730] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.730] lstrlenW (lpString=".1cd") returned 4 [0069.730] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.730] lstrlenW (lpString=".jpg") returned 4 [0069.731] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.731] lstrlenW (lpString=".doc") returned 4 [0069.731] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString=".docx") returned 5 [0069.731] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0069.731] lstrlenW (lpString=".pdf") returned 4 [0069.731] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString=".xls") returned 4 [0069.731] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString=".xlsx") returned 5 [0069.731] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0069.731] lstrlenW (lpString=".ppt") returned 4 [0069.731] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.731] lstrlenW (lpString=".zip") returned 4 [0069.731] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.731] lstrlenW (lpString=".rar") returned 4 [0069.731] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString=".bz2") returned 4 [0069.731] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString=".7z") returned 3 [0069.731] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.731] lstrlenW (lpString=".dbf") returned 4 [0069.731] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.731] lstrlenW (lpString=".1cd") returned 4 [0069.731] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0069.731] lstrlenW (lpString=".jpg") returned 4 [0069.731] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.732] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.732] lstrlenW (lpString="SETUP.XML") returned 9 [0069.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0069.732] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=9352) returned 1 [0069.732] CloseHandle (hObject=0x1c4) returned 1 [0069.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0069.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0069.732] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0069.732] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0069.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0069.733] GetLastError () returned 0x0 [0069.733] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x2488, lpOverlapped=0x0) returned 1 [0069.819] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x2490, lpOverlapped=0x0) returned 1 [0069.820] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0069.820] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.820] SetEndOfFile (hFile=0x1d0) returned 1 [0069.820] CloseHandle (hObject=0x1d0) returned 1 [0069.821] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0069.821] SetEndOfFile (hFile=0x1c4) returned 1 [0069.822] CloseHandle (hObject=0x1c4) returned 1 [0069.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0069.822] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0069.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.822] lstrlenW (lpString=".doc") returned 4 [0069.822] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.823] lstrlenW (lpString=".docx") returned 5 [0069.823] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0069.823] lstrlenW (lpString=".pdf") returned 4 [0069.823] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.823] lstrlenW (lpString=".xls") returned 4 [0069.823] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.823] lstrlenW (lpString=".xlsx") returned 5 [0069.823] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0069.823] lstrlenW (lpString=".ppt") returned 4 [0069.823] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.823] lstrlenW (lpString=".zip") returned 4 [0069.823] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.823] lstrlenW (lpString=".rar") returned 4 [0069.823] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.823] lstrlenW (lpString=".bz2") returned 4 [0069.823] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.823] lstrlenW (lpString=".7z") returned 3 [0069.823] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.823] lstrlenW (lpString=".dbf") returned 4 [0069.824] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.824] lstrlenW (lpString=".1cd") returned 4 [0069.824] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.824] lstrlenW (lpString=".jpg") returned 4 [0069.824] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.824] lstrlenW (lpString=".doc") returned 4 [0069.824] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString=".docx") returned 5 [0069.824] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0069.824] lstrlenW (lpString=".pdf") returned 4 [0069.824] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString=".xls") returned 4 [0069.824] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString=".xlsx") returned 5 [0069.824] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0069.824] lstrlenW (lpString=".ppt") returned 4 [0069.824] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.824] lstrlenW (lpString=".zip") returned 4 [0069.824] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.824] lstrlenW (lpString=".rar") returned 4 [0069.824] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString=".bz2") returned 4 [0069.824] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.824] lstrlenW (lpString=".7z") returned 3 [0069.825] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.825] lstrlenW (lpString=".dbf") returned 4 [0069.825] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.825] lstrlenW (lpString=".1cd") returned 4 [0069.825] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0069.825] lstrlenW (lpString=".jpg") returned 4 [0069.825] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.825] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.825] lstrlenW (lpString="Office32WW.XML") returned 14 [0069.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0069.825] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=4274) returned 1 [0069.825] CloseHandle (hObject=0x1c4) returned 1 [0069.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0069.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0069.826] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0069.826] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0069.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0069.826] GetLastError () returned 0x0 [0069.826] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x10b2, lpOverlapped=0x0) returned 1 [0069.976] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0069.977] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0069.977] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf0, lpOverlapped=0x0) returned 1 [0069.977] SetEndOfFile (hFile=0x1d0) returned 1 [0069.977] CloseHandle (hObject=0x1d0) returned 1 [0069.978] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0069.978] SetEndOfFile (hFile=0x1c4) returned 1 [0069.978] CloseHandle (hObject=0x1c4) returned 1 [0069.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0069.979] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0069.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.979] lstrlenW (lpString=".doc") returned 4 [0069.979] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.979] lstrlenW (lpString=".docx") returned 5 [0069.979] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0069.979] lstrlenW (lpString=".pdf") returned 4 [0069.979] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.979] lstrlenW (lpString=".xls") returned 4 [0069.979] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.979] lstrlenW (lpString=".xlsx") returned 5 [0069.979] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0069.979] lstrlenW (lpString=".ppt") returned 4 [0069.979] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.980] lstrlenW (lpString=".zip") returned 4 [0069.980] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.980] lstrlenW (lpString=".rar") returned 4 [0069.980] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString=".bz2") returned 4 [0069.980] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString=".7z") returned 3 [0069.980] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.980] lstrlenW (lpString=".dbf") returned 4 [0069.980] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.980] lstrlenW (lpString=".1cd") returned 4 [0069.980] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.980] lstrlenW (lpString=".jpg") returned 4 [0069.980] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.980] lstrlenW (lpString=".doc") returned 4 [0069.980] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString=".docx") returned 5 [0069.980] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0069.980] lstrlenW (lpString=".pdf") returned 4 [0069.980] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString=".xls") returned 4 [0069.980] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.980] lstrlenW (lpString=".xlsx") returned 5 [0069.981] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0069.981] lstrlenW (lpString=".ppt") returned 4 [0069.981] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.981] lstrlenW (lpString=".zip") returned 4 [0069.981] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.981] lstrlenW (lpString=".rar") returned 4 [0069.981] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.981] lstrlenW (lpString=".bz2") returned 4 [0069.981] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.981] lstrlenW (lpString=".7z") returned 3 [0069.981] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.981] lstrlenW (lpString=".dbf") returned 4 [0069.981] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.981] lstrlenW (lpString=".1cd") returned 4 [0069.981] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0069.981] lstrlenW (lpString=".jpg") returned 4 [0069.981] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.981] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.981] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0069.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0069.982] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1450) returned 1 [0069.982] CloseHandle (hObject=0x1c4) returned 1 [0069.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0069.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0069.982] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0069.982] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0069.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.211] GetLastError () returned 0x0 [0070.211] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x5aa, lpOverlapped=0x0) returned 1 [0070.368] WriteFile (in: hFile=0x18c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0070.369] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0070.369] WriteFile (in: hFile=0x18c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf6, lpOverlapped=0x0) returned 1 [0070.369] SetEndOfFile (hFile=0x18c) returned 1 [0070.369] CloseHandle (hObject=0x18c) returned 1 [0070.370] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0070.370] SetEndOfFile (hFile=0x1c4) returned 1 [0070.370] CloseHandle (hObject=0x1c4) returned 1 [0070.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.371] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0070.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.371] lstrlenW (lpString=".doc") returned 4 [0070.371] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.371] lstrlenW (lpString=".docx") returned 5 [0070.371] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.371] lstrlenW (lpString=".pdf") returned 4 [0070.371] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.371] lstrlenW (lpString=".xls") returned 4 [0070.371] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.371] lstrlenW (lpString=".xlsx") returned 5 [0070.371] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.371] lstrlenW (lpString=".ppt") returned 4 [0070.371] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.372] lstrlenW (lpString=".zip") returned 4 [0070.372] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.372] lstrlenW (lpString=".rar") returned 4 [0070.372] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.372] lstrlenW (lpString=".bz2") returned 4 [0070.372] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.372] lstrlenW (lpString=".7z") returned 3 [0070.372] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.372] lstrlenW (lpString=".dbf") returned 4 [0070.372] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.372] lstrlenW (lpString=".1cd") returned 4 [0070.372] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.372] lstrlenW (lpString=".jpg") returned 4 [0070.372] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.372] lstrlenW (lpString=".doc") returned 4 [0070.372] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.372] lstrlenW (lpString=".docx") returned 5 [0070.372] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.372] lstrlenW (lpString=".pdf") returned 4 [0070.372] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.372] lstrlenW (lpString=".xls") returned 4 [0070.372] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.373] lstrlenW (lpString=".xlsx") returned 5 [0070.373] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.373] lstrlenW (lpString=".ppt") returned 4 [0070.373] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.373] lstrlenW (lpString=".zip") returned 4 [0070.373] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.373] lstrlenW (lpString=".rar") returned 4 [0070.373] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.373] lstrlenW (lpString=".bz2") returned 4 [0070.373] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.373] lstrlenW (lpString=".7z") returned 3 [0070.373] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.373] lstrlenW (lpString=".dbf") returned 4 [0070.373] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.373] lstrlenW (lpString=".1cd") returned 4 [0070.373] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0070.373] lstrlenW (lpString=".jpg") returned 4 [0070.373] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.373] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.373] lstrlenW (lpString="SETUP.XML") returned 9 [0070.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.701] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=16683) returned 1 [0070.701] CloseHandle (hObject=0x1cc) returned 1 [0070.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0070.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.701] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0070.701] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0070.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0071.163] GetLastError () returned 0x0 [0071.163] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x412b, lpOverlapped=0x0) returned 1 [0071.222] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x4130, lpOverlapped=0x0) returned 1 [0071.246] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0071.246] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.246] SetEndOfFile (hFile=0x1c8) returned 1 [0071.246] CloseHandle (hObject=0x1c8) returned 1 [0071.247] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.247] SetEndOfFile (hFile=0x1cc) returned 1 [0071.247] CloseHandle (hObject=0x1cc) returned 1 [0071.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.248] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0071.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.248] lstrlenW (lpString=".doc") returned 4 [0071.248] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.248] lstrlenW (lpString=".docx") returned 5 [0071.248] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.248] lstrlenW (lpString=".pdf") returned 4 [0071.248] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.248] lstrlenW (lpString=".xls") returned 4 [0071.248] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.248] lstrlenW (lpString=".xlsx") returned 5 [0071.248] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.248] lstrlenW (lpString=".ppt") returned 4 [0071.248] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.248] lstrlenW (lpString=".zip") returned 4 [0071.248] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.248] lstrlenW (lpString=".rar") returned 4 [0071.248] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.248] lstrlenW (lpString=".bz2") returned 4 [0071.249] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString=".7z") returned 3 [0071.249] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.249] lstrlenW (lpString=".dbf") returned 4 [0071.249] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.249] lstrlenW (lpString=".1cd") returned 4 [0071.249] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.249] lstrlenW (lpString=".jpg") returned 4 [0071.249] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.249] lstrlenW (lpString=".doc") returned 4 [0071.249] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString=".docx") returned 5 [0071.249] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.249] lstrlenW (lpString=".pdf") returned 4 [0071.249] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString=".xls") returned 4 [0071.249] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString=".xlsx") returned 5 [0071.249] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.249] lstrlenW (lpString=".ppt") returned 4 [0071.249] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.249] lstrlenW (lpString=".zip") returned 4 [0071.249] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.249] lstrlenW (lpString=".rar") returned 4 [0071.249] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString=".bz2") returned 4 [0071.249] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.249] lstrlenW (lpString=".7z") returned 3 [0071.249] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.250] lstrlenW (lpString=".dbf") returned 4 [0071.250] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.250] lstrlenW (lpString=".1cd") returned 4 [0071.250] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0071.250] lstrlenW (lpString=".jpg") returned 4 [0071.250] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.250] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.250] lstrlenW (lpString="SETUP.XML") returned 9 [0071.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.357] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=6241) returned 1 [0071.357] CloseHandle (hObject=0x1a4) returned 1 [0071.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0071.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.358] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.358] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.358] GetLastError () returned 0x0 [0071.358] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x1861, lpOverlapped=0x0) returned 1 [0071.618] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x1870, lpOverlapped=0x0) returned 1 [0071.619] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0071.619] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.619] SetEndOfFile (hFile=0x19c) returned 1 [0071.619] CloseHandle (hObject=0x19c) returned 1 [0071.619] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.619] SetEndOfFile (hFile=0x1a4) returned 1 [0071.620] CloseHandle (hObject=0x1a4) returned 1 [0071.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.620] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0071.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.621] lstrlenW (lpString=".doc") returned 4 [0071.621] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.621] lstrlenW (lpString=".docx") returned 5 [0071.621] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.621] lstrlenW (lpString=".pdf") returned 4 [0071.621] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.621] lstrlenW (lpString=".xls") returned 4 [0071.621] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.621] lstrlenW (lpString=".xlsx") returned 5 [0071.621] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.621] lstrlenW (lpString=".ppt") returned 4 [0071.621] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.621] lstrlenW (lpString=".zip") returned 4 [0071.621] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.621] lstrlenW (lpString=".rar") returned 4 [0071.621] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.621] lstrlenW (lpString=".bz2") returned 4 [0071.621] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.621] lstrlenW (lpString=".7z") returned 3 [0071.621] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.621] lstrlenW (lpString=".dbf") returned 4 [0071.621] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.622] lstrlenW (lpString=".1cd") returned 4 [0071.622] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.622] lstrlenW (lpString=".jpg") returned 4 [0071.622] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.622] lstrlenW (lpString=".doc") returned 4 [0071.622] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.622] lstrlenW (lpString=".docx") returned 5 [0071.622] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.622] lstrlenW (lpString=".pdf") returned 4 [0071.622] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.622] lstrlenW (lpString=".xls") returned 4 [0071.622] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.622] lstrlenW (lpString=".xlsx") returned 5 [0071.622] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.622] lstrlenW (lpString=".ppt") returned 4 [0071.622] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.622] lstrlenW (lpString=".zip") returned 4 [0071.622] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.622] lstrlenW (lpString=".rar") returned 4 [0071.622] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.622] lstrlenW (lpString=".bz2") returned 4 [0071.622] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.622] lstrlenW (lpString=".7z") returned 3 [0071.622] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.622] lstrlenW (lpString=".dbf") returned 4 [0071.623] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.623] lstrlenW (lpString=".1cd") returned 4 [0071.623] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0071.623] lstrlenW (lpString=".jpg") returned 4 [0071.623] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.623] lstrcmpiW (lpString1=".HTM", lpString2=".beets") returned 1 [0071.623] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0071.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.624] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=11463) returned 1 [0071.624] CloseHandle (hObject=0x1a4) returned 1 [0071.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0071.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.625] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.625] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.640] GetLastError () returned 0x0 [0071.640] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0071.645] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0071.646] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0071.646] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.646] SetEndOfFile (hFile=0x19c) returned 1 [0071.646] CloseHandle (hObject=0x19c) returned 1 [0071.646] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.646] SetEndOfFile (hFile=0x1a4) returned 1 [0071.647] CloseHandle (hObject=0x1a4) returned 1 [0071.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.648] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0071.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.648] lstrlenW (lpString=".doc") returned 4 [0071.648] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0071.648] lstrlenW (lpString=".docx") returned 5 [0071.648] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0071.648] lstrlenW (lpString=".pdf") returned 4 [0071.649] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0071.649] lstrlenW (lpString=".xls") returned 4 [0071.649] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0071.649] lstrlenW (lpString=".xlsx") returned 5 [0071.649] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0071.649] lstrlenW (lpString=".ppt") returned 4 [0071.649] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0071.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.649] lstrlenW (lpString=".zip") returned 4 [0071.649] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0071.649] lstrlenW (lpString=".rar") returned 4 [0071.649] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0071.649] lstrlenW (lpString=".bz2") returned 4 [0071.649] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0071.649] lstrlenW (lpString=".7z") returned 3 [0071.649] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0071.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.649] lstrlenW (lpString=".dbf") returned 4 [0071.649] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0071.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.649] lstrlenW (lpString=".1cd") returned 4 [0071.649] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0071.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.649] lstrlenW (lpString=".jpg") returned 4 [0071.649] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0071.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.649] lstrlenW (lpString=".doc") returned 4 [0071.649] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0071.650] lstrlenW (lpString=".docx") returned 5 [0071.650] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0071.650] lstrlenW (lpString=".pdf") returned 4 [0071.650] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0071.650] lstrlenW (lpString=".xls") returned 4 [0071.650] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0071.650] lstrlenW (lpString=".xlsx") returned 5 [0071.650] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0071.650] lstrlenW (lpString=".ppt") returned 4 [0071.650] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0071.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.650] lstrlenW (lpString=".zip") returned 4 [0071.650] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0071.650] lstrlenW (lpString=".rar") returned 4 [0071.650] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0071.650] lstrlenW (lpString=".bz2") returned 4 [0071.650] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0071.650] lstrlenW (lpString=".7z") returned 3 [0071.650] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0071.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.650] lstrlenW (lpString=".dbf") returned 4 [0071.650] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0071.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.650] lstrlenW (lpString=".1cd") returned 4 [0071.650] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0071.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0071.650] lstrlenW (lpString=".jpg") returned 4 [0071.650] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0071.650] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.651] lstrlenW (lpString="PHONE.XML") returned 9 [0071.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.663] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1844) returned 1 [0071.663] CloseHandle (hObject=0x1d0) returned 1 [0071.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0071.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.663] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.663] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0071.663] GetLastError () returned 0x0 [0071.663] ReadFile (in: hFile=0x1d0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x734, lpOverlapped=0x0) returned 1 [0071.859] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x740, lpOverlapped=0x0) returned 1 [0071.860] ReadFile (in: hFile=0x1d0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0071.860] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.880] SetEndOfFile (hFile=0x1c4) returned 1 [0071.884] CloseHandle (hObject=0x1c4) returned 1 [0071.884] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.884] SetEndOfFile (hFile=0x1d0) returned 1 [0071.885] CloseHandle (hObject=0x1d0) returned 1 [0071.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0071.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.886] lstrlenW (lpString=".doc") returned 4 [0071.886] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.886] lstrlenW (lpString=".docx") returned 5 [0071.886] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0071.886] lstrlenW (lpString=".pdf") returned 4 [0071.886] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.886] lstrlenW (lpString=".xls") returned 4 [0071.886] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.886] lstrlenW (lpString=".xlsx") returned 5 [0071.886] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0071.886] lstrlenW (lpString=".ppt") returned 4 [0071.886] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.886] lstrlenW (lpString=".zip") returned 4 [0071.886] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.886] lstrlenW (lpString=".rar") returned 4 [0071.886] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.886] lstrlenW (lpString=".bz2") returned 4 [0071.886] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.886] lstrlenW (lpString=".7z") returned 3 [0071.886] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.886] lstrlenW (lpString=".dbf") returned 4 [0071.886] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.887] lstrlenW (lpString=".1cd") returned 4 [0071.887] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.887] lstrlenW (lpString=".jpg") returned 4 [0071.887] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.887] lstrlenW (lpString=".doc") returned 4 [0071.887] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.887] lstrlenW (lpString=".docx") returned 5 [0071.887] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0071.887] lstrlenW (lpString=".pdf") returned 4 [0071.887] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.887] lstrlenW (lpString=".xls") returned 4 [0071.887] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.887] lstrlenW (lpString=".xlsx") returned 5 [0071.887] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0071.887] lstrlenW (lpString=".ppt") returned 4 [0071.887] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.887] lstrlenW (lpString=".zip") returned 4 [0071.887] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.887] lstrlenW (lpString=".rar") returned 4 [0071.887] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.887] lstrlenW (lpString=".bz2") returned 4 [0071.887] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.887] lstrlenW (lpString=".7z") returned 3 [0071.888] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.888] lstrlenW (lpString=".dbf") returned 4 [0071.888] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.888] lstrlenW (lpString=".1cd") returned 4 [0071.888] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0071.888] lstrlenW (lpString=".jpg") returned 4 [0071.888] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.888] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.888] lstrlenW (lpString="TIME.XML") returned 8 [0071.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.889] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=8564) returned 1 [0071.889] CloseHandle (hObject=0x1d0) returned 1 [0071.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0071.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.889] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.889] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0071.890] GetLastError () returned 0x0 [0071.890] ReadFile (in: hFile=0x1d0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x2174, lpOverlapped=0x0) returned 1 [0071.978] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x2180, lpOverlapped=0x0) returned 1 [0071.979] ReadFile (in: hFile=0x1d0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0071.979] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe4, lpOverlapped=0x0) returned 1 [0071.979] SetEndOfFile (hFile=0x1c4) returned 1 [0071.979] CloseHandle (hObject=0x1c4) returned 1 [0071.979] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0071.979] SetEndOfFile (hFile=0x1d0) returned 1 [0071.980] CloseHandle (hObject=0x1d0) returned 1 [0071.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.980] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0071.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.981] lstrlenW (lpString=".doc") returned 4 [0071.981] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString=".docx") returned 5 [0071.981] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0071.981] lstrlenW (lpString=".pdf") returned 4 [0071.981] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString=".xls") returned 4 [0071.981] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString=".xlsx") returned 5 [0071.981] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0071.981] lstrlenW (lpString=".ppt") returned 4 [0071.981] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.981] lstrlenW (lpString=".zip") returned 4 [0071.981] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.981] lstrlenW (lpString=".rar") returned 4 [0071.981] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString=".bz2") returned 4 [0071.981] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString=".7z") returned 3 [0071.981] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.981] lstrlenW (lpString=".dbf") returned 4 [0071.981] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.981] lstrlenW (lpString=".1cd") returned 4 [0071.981] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.981] lstrlenW (lpString=".jpg") returned 4 [0071.981] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.981] lstrlenW (lpString=".doc") returned 4 [0071.981] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.981] lstrlenW (lpString=".docx") returned 5 [0071.981] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0071.982] lstrlenW (lpString=".pdf") returned 4 [0071.982] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.982] lstrlenW (lpString=".xls") returned 4 [0071.982] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.982] lstrlenW (lpString=".xlsx") returned 5 [0071.982] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0071.982] lstrlenW (lpString=".ppt") returned 4 [0071.982] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.982] lstrlenW (lpString=".zip") returned 4 [0071.982] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.982] lstrlenW (lpString=".rar") returned 4 [0071.982] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.982] lstrlenW (lpString=".bz2") returned 4 [0071.982] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.982] lstrlenW (lpString=".7z") returned 3 [0071.982] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.982] lstrlenW (lpString=".dbf") returned 4 [0071.982] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.982] lstrlenW (lpString=".1cd") returned 4 [0071.982] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0071.982] lstrlenW (lpString=".jpg") returned 4 [0071.982] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.982] lstrcmpiW (lpString1=".htm", lpString2=".beets") returned 1 [0071.983] lstrlenW (lpString="Bears.htm") returned 9 [0071.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.997] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=255) returned 1 [0071.997] CloseHandle (hObject=0x1a4) returned 1 [0071.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0071.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0071.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.997] lstrlenW (lpString=".doc") returned 4 [0071.997] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0071.997] lstrlenW (lpString=".docx") returned 5 [0071.997] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0071.997] lstrlenW (lpString=".pdf") returned 4 [0071.997] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0071.997] lstrlenW (lpString=".xls") returned 4 [0071.997] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0071.997] lstrlenW (lpString=".xlsx") returned 5 [0071.997] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0071.997] lstrlenW (lpString=".ppt") returned 4 [0071.997] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0071.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.998] lstrlenW (lpString=".zip") returned 4 [0071.998] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0071.998] lstrlenW (lpString=".rar") returned 4 [0071.998] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0071.998] lstrlenW (lpString=".bz2") returned 4 [0071.998] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0071.998] lstrlenW (lpString=".7z") returned 3 [0071.998] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0071.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.998] lstrlenW (lpString=".dbf") returned 4 [0071.998] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0071.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.998] lstrlenW (lpString=".1cd") returned 4 [0071.998] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0071.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.998] lstrlenW (lpString=".jpg") returned 4 [0071.998] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0071.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.998] lstrlenW (lpString=".doc") returned 4 [0071.998] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0071.998] lstrlenW (lpString=".docx") returned 5 [0071.998] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0071.998] lstrlenW (lpString=".pdf") returned 4 [0071.998] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0071.998] lstrlenW (lpString=".xls") returned 4 [0071.998] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0071.998] lstrlenW (lpString=".xlsx") returned 5 [0071.998] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0071.998] lstrlenW (lpString=".ppt") returned 4 [0071.998] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0071.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.998] lstrlenW (lpString=".zip") returned 4 [0071.998] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0071.998] lstrlenW (lpString=".rar") returned 4 [0071.999] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0071.999] lstrlenW (lpString=".bz2") returned 4 [0071.999] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0071.999] lstrlenW (lpString=".7z") returned 3 [0071.999] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0071.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.999] lstrlenW (lpString=".dbf") returned 4 [0071.999] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0071.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.999] lstrlenW (lpString=".1cd") returned 4 [0071.999] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0071.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0071.999] lstrlenW (lpString=".jpg") returned 4 [0071.999] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0071.999] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0071.999] lstrlenW (lpString="Bears.jpg") returned 9 [0071.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.999] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1074) returned 1 [0071.999] CloseHandle (hObject=0x1a4) returned 1 [0071.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0072.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.000] lstrlenW (lpString=".doc") returned 4 [0072.000] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.000] lstrlenW (lpString=".docx") returned 5 [0072.000] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0072.000] lstrlenW (lpString=".pdf") returned 4 [0072.000] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.000] lstrlenW (lpString=".xls") returned 4 [0072.000] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.000] lstrlenW (lpString=".xlsx") returned 5 [0072.000] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0072.000] lstrlenW (lpString=".ppt") returned 4 [0072.000] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.000] lstrlenW (lpString=".zip") returned 4 [0072.000] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.000] lstrlenW (lpString=".rar") returned 4 [0072.000] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.000] lstrlenW (lpString=".bz2") returned 4 [0072.000] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.000] lstrlenW (lpString=".7z") returned 3 [0072.000] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.000] lstrlenW (lpString=".dbf") returned 4 [0072.000] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.000] lstrlenW (lpString=".1cd") returned 4 [0072.000] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.000] lstrlenW (lpString=".jpg") returned 4 [0072.000] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.001] lstrlenW (lpString=".doc") returned 4 [0072.001] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.001] lstrlenW (lpString=".docx") returned 5 [0072.001] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0072.001] lstrlenW (lpString=".pdf") returned 4 [0072.001] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.001] lstrlenW (lpString=".xls") returned 4 [0072.001] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.001] lstrlenW (lpString=".xlsx") returned 5 [0072.001] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0072.001] lstrlenW (lpString=".ppt") returned 4 [0072.001] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.001] lstrlenW (lpString=".zip") returned 4 [0072.001] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.001] lstrlenW (lpString=".rar") returned 4 [0072.001] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.001] lstrlenW (lpString=".bz2") returned 4 [0072.001] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.001] lstrlenW (lpString=".7z") returned 3 [0072.001] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.001] lstrlenW (lpString=".dbf") returned 4 [0072.001] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.001] lstrlenW (lpString=".1cd") returned 4 [0072.001] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0072.001] lstrlenW (lpString=".jpg") returned 4 [0072.001] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.002] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.002] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0072.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.002] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=2575) returned 1 [0072.002] CloseHandle (hObject=0x1a4) returned 1 [0072.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0072.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.003] lstrlenW (lpString=".doc") returned 4 [0072.003] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.003] lstrlenW (lpString=".docx") returned 5 [0072.003] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0072.003] lstrlenW (lpString=".pdf") returned 4 [0072.003] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.003] lstrlenW (lpString=".xls") returned 4 [0072.003] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.003] lstrlenW (lpString=".xlsx") returned 5 [0072.003] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0072.003] lstrlenW (lpString=".ppt") returned 4 [0072.003] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.003] lstrlenW (lpString=".zip") returned 4 [0072.003] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.003] lstrlenW (lpString=".rar") returned 4 [0072.003] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.003] lstrlenW (lpString=".bz2") returned 4 [0072.003] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.003] lstrlenW (lpString=".7z") returned 3 [0072.003] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.003] lstrlenW (lpString=".dbf") returned 4 [0072.003] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.003] lstrlenW (lpString=".1cd") returned 4 [0072.003] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.004] lstrlenW (lpString=".jpg") returned 4 [0072.004] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.004] lstrlenW (lpString=".doc") returned 4 [0072.004] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.004] lstrlenW (lpString=".docx") returned 5 [0072.004] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0072.004] lstrlenW (lpString=".pdf") returned 4 [0072.004] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.004] lstrlenW (lpString=".xls") returned 4 [0072.004] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.004] lstrlenW (lpString=".xlsx") returned 5 [0072.004] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0072.004] lstrlenW (lpString=".ppt") returned 4 [0072.004] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.004] lstrlenW (lpString=".zip") returned 4 [0072.004] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.004] lstrlenW (lpString=".rar") returned 4 [0072.004] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.004] lstrlenW (lpString=".bz2") returned 4 [0072.004] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.004] lstrlenW (lpString=".7z") returned 3 [0072.004] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.004] lstrlenW (lpString=".dbf") returned 4 [0072.004] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.004] lstrlenW (lpString=".1cd") returned 4 [0072.004] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0072.004] lstrlenW (lpString=".jpg") returned 4 [0072.004] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.005] lstrcmpiW (lpString1=".gif", lpString2=".beets") returned 1 [0072.005] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0072.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.005] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=4587) returned 1 [0072.005] CloseHandle (hObject=0x1a4) returned 1 [0072.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0072.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.005] lstrlenW (lpString=".doc") returned 4 [0072.005] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0072.005] lstrlenW (lpString=".docx") returned 5 [0072.005] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0072.005] lstrlenW (lpString=".pdf") returned 4 [0072.005] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0072.005] lstrlenW (lpString=".xls") returned 4 [0072.005] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0072.005] lstrlenW (lpString=".xlsx") returned 5 [0072.006] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0072.006] lstrlenW (lpString=".ppt") returned 4 [0072.006] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0072.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.006] lstrlenW (lpString=".zip") returned 4 [0072.006] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0072.006] lstrlenW (lpString=".rar") returned 4 [0072.006] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0072.006] lstrlenW (lpString=".bz2") returned 4 [0072.006] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0072.006] lstrlenW (lpString=".7z") returned 3 [0072.006] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0072.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.006] lstrlenW (lpString=".dbf") returned 4 [0072.006] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0072.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.006] lstrlenW (lpString=".1cd") returned 4 [0072.006] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0072.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.006] lstrlenW (lpString=".jpg") returned 4 [0072.006] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0072.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.006] lstrlenW (lpString=".doc") returned 4 [0072.006] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0072.006] lstrlenW (lpString=".docx") returned 5 [0072.006] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0072.006] lstrlenW (lpString=".pdf") returned 4 [0072.006] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0072.006] lstrlenW (lpString=".xls") returned 4 [0072.006] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0072.006] lstrlenW (lpString=".xlsx") returned 5 [0072.006] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0072.006] lstrlenW (lpString=".ppt") returned 4 [0072.006] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0072.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.007] lstrlenW (lpString=".zip") returned 4 [0072.007] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0072.007] lstrlenW (lpString=".rar") returned 4 [0072.007] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0072.007] lstrlenW (lpString=".bz2") returned 4 [0072.007] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0072.007] lstrlenW (lpString=".7z") returned 3 [0072.007] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0072.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.007] lstrlenW (lpString=".dbf") returned 4 [0072.007] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0072.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.007] lstrlenW (lpString=".1cd") returned 4 [0072.007] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0072.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0072.007] lstrlenW (lpString=".jpg") returned 4 [0072.008] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0072.008] lstrcmpiW (lpString1=".gif", lpString2=".beets") returned 1 [0072.008] lstrlenW (lpString="Connectivity.gif") returned 16 [0072.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.008] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=2319) returned 1 [0072.008] CloseHandle (hObject=0x1a4) returned 1 [0072.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0072.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.009] lstrlenW (lpString=".doc") returned 4 [0072.009] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0072.009] lstrlenW (lpString=".docx") returned 5 [0072.009] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0072.009] lstrlenW (lpString=".pdf") returned 4 [0072.009] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0072.009] lstrlenW (lpString=".xls") returned 4 [0072.009] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0072.009] lstrlenW (lpString=".xlsx") returned 5 [0072.009] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0072.009] lstrlenW (lpString=".ppt") returned 4 [0072.009] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0072.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.009] lstrlenW (lpString=".zip") returned 4 [0072.009] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0072.009] lstrlenW (lpString=".rar") returned 4 [0072.009] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0072.009] lstrlenW (lpString=".bz2") returned 4 [0072.009] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0072.009] lstrlenW (lpString=".7z") returned 3 [0072.009] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0072.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.009] lstrlenW (lpString=".dbf") returned 4 [0072.009] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0072.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.009] lstrlenW (lpString=".1cd") returned 4 [0072.009] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0072.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.009] lstrlenW (lpString=".jpg") returned 4 [0072.009] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0072.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.010] lstrlenW (lpString=".doc") returned 4 [0072.010] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0072.010] lstrlenW (lpString=".docx") returned 5 [0072.010] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0072.010] lstrlenW (lpString=".pdf") returned 4 [0072.010] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0072.010] lstrlenW (lpString=".xls") returned 4 [0072.010] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0072.010] lstrlenW (lpString=".xlsx") returned 5 [0072.010] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0072.010] lstrlenW (lpString=".ppt") returned 4 [0072.010] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0072.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.010] lstrlenW (lpString=".zip") returned 4 [0072.010] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0072.010] lstrlenW (lpString=".rar") returned 4 [0072.010] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0072.010] lstrlenW (lpString=".bz2") returned 4 [0072.010] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0072.010] lstrlenW (lpString=".7z") returned 3 [0072.010] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0072.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.010] lstrlenW (lpString=".dbf") returned 4 [0072.010] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0072.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.010] lstrlenW (lpString=".1cd") returned 4 [0072.010] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0072.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0072.010] lstrlenW (lpString=".jpg") returned 4 [0072.010] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0072.011] lstrcmpiW (lpString1=".ini", lpString2=".beets") returned 1 [0072.011] lstrlenW (lpString="Desktop.ini") returned 11 [0072.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.011] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=645) returned 1 [0072.011] CloseHandle (hObject=0x1a4) returned 1 [0072.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0072.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.011] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0072.011] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0072.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0072.012] GetLastError () returned 0x0 [0072.012] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x285, lpOverlapped=0x0) returned 1 [0072.013] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x290, lpOverlapped=0x0) returned 1 [0072.014] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0072.014] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.014] SetEndOfFile (hFile=0x214) returned 1 [0072.014] CloseHandle (hObject=0x214) returned 1 [0072.014] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0072.014] SetEndOfFile (hFile=0x1a4) returned 1 [0072.015] CloseHandle (hObject=0x1a4) returned 1 [0072.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x26) returned 1 [0072.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0072.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.016] lstrlenW (lpString=".doc") returned 4 [0072.016] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0072.016] lstrlenW (lpString=".docx") returned 5 [0072.016] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0072.016] lstrlenW (lpString=".pdf") returned 4 [0072.016] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0072.016] lstrlenW (lpString=".xls") returned 4 [0072.016] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0072.016] lstrlenW (lpString=".xlsx") returned 5 [0072.016] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0072.016] lstrlenW (lpString=".ppt") returned 4 [0072.016] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0072.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.016] lstrlenW (lpString=".zip") returned 4 [0072.016] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0072.016] lstrlenW (lpString=".rar") returned 4 [0072.016] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0072.016] lstrlenW (lpString=".bz2") returned 4 [0072.016] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0072.016] lstrlenW (lpString=".7z") returned 3 [0072.016] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0072.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.016] lstrlenW (lpString=".dbf") returned 4 [0072.016] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0072.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.016] lstrlenW (lpString=".1cd") returned 4 [0072.016] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0072.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.016] lstrlenW (lpString=".jpg") returned 4 [0072.016] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0072.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.017] lstrlenW (lpString=".doc") returned 4 [0072.017] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0072.017] lstrlenW (lpString=".docx") returned 5 [0072.017] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0072.017] lstrlenW (lpString=".pdf") returned 4 [0072.017] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0072.017] lstrlenW (lpString=".xls") returned 4 [0072.017] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0072.017] lstrlenW (lpString=".xlsx") returned 5 [0072.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0072.017] lstrlenW (lpString=".ppt") returned 4 [0072.017] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0072.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.017] lstrlenW (lpString=".zip") returned 4 [0072.017] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0072.017] lstrlenW (lpString=".rar") returned 4 [0072.017] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0072.017] lstrlenW (lpString=".bz2") returned 4 [0072.017] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0072.017] lstrlenW (lpString=".7z") returned 3 [0072.017] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0072.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.017] lstrlenW (lpString=".dbf") returned 4 [0072.017] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0072.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.017] lstrlenW (lpString=".1cd") returned 4 [0072.017] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0072.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0072.017] lstrlenW (lpString=".jpg") returned 4 [0072.017] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0072.018] lstrcmpiW (lpString1=".emf", lpString2=".beets") returned 1 [0072.018] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0072.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.018] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3792) returned 1 [0072.018] CloseHandle (hObject=0x1a4) returned 1 [0072.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0072.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.018] lstrlenW (lpString=".doc") returned 4 [0072.018] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.018] lstrlenW (lpString=".docx") returned 5 [0072.018] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0072.018] lstrlenW (lpString=".pdf") returned 4 [0072.019] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.019] lstrlenW (lpString=".xls") returned 4 [0072.019] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.019] lstrlenW (lpString=".xlsx") returned 5 [0072.019] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0072.019] lstrlenW (lpString=".ppt") returned 4 [0072.019] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.019] lstrlenW (lpString=".zip") returned 4 [0072.019] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.019] lstrlenW (lpString=".rar") returned 4 [0072.019] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.019] lstrlenW (lpString=".bz2") returned 4 [0072.019] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.019] lstrlenW (lpString=".7z") returned 3 [0072.019] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.019] lstrlenW (lpString=".dbf") returned 4 [0072.019] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.019] lstrlenW (lpString=".1cd") returned 4 [0072.019] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0072.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.019] lstrlenW (lpString=".jpg") returned 4 [0072.019] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0072.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.019] lstrlenW (lpString=".doc") returned 4 [0072.019] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0072.019] lstrlenW (lpString=".docx") returned 5 [0072.019] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0072.019] lstrlenW (lpString=".pdf") returned 4 [0072.020] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0072.020] lstrlenW (lpString=".xls") returned 4 [0072.020] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0072.020] lstrlenW (lpString=".xlsx") returned 5 [0072.020] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0072.020] lstrlenW (lpString=".ppt") returned 4 [0072.020] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0072.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.020] lstrlenW (lpString=".zip") returned 4 [0072.020] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0072.020] lstrlenW (lpString=".rar") returned 4 [0072.020] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0072.020] lstrlenW (lpString=".bz2") returned 4 [0072.020] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0072.020] lstrlenW (lpString=".7z") returned 3 [0072.020] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0072.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.020] lstrlenW (lpString=".dbf") returned 4 [0072.020] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0072.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.020] lstrlenW (lpString=".1cd") returned 4 [0072.020] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0072.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0072.020] lstrlenW (lpString=".jpg") returned 4 [0072.020] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0072.020] lstrcmpiW (lpString1=".htm", lpString2=".beets") returned 1 [0072.020] lstrlenW (lpString="Garden.htm") returned 10 [0072.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.021] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=231) returned 1 [0072.021] CloseHandle (hObject=0x1a4) returned 1 [0072.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0072.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.021] lstrlenW (lpString=".doc") returned 4 [0072.021] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0072.021] lstrlenW (lpString=".docx") returned 5 [0072.021] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0072.021] lstrlenW (lpString=".pdf") returned 4 [0072.021] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0072.021] lstrlenW (lpString=".xls") returned 4 [0072.021] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0072.021] lstrlenW (lpString=".xlsx") returned 5 [0072.021] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0072.021] lstrlenW (lpString=".ppt") returned 4 [0072.021] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0072.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.022] lstrlenW (lpString=".zip") returned 4 [0072.022] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0072.022] lstrlenW (lpString=".rar") returned 4 [0072.022] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0072.022] lstrlenW (lpString=".bz2") returned 4 [0072.022] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0072.022] lstrlenW (lpString=".7z") returned 3 [0072.022] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0072.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.022] lstrlenW (lpString=".dbf") returned 4 [0072.022] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0072.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.022] lstrlenW (lpString=".1cd") returned 4 [0072.022] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0072.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.022] lstrlenW (lpString=".jpg") returned 4 [0072.022] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0072.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.022] lstrlenW (lpString=".doc") returned 4 [0072.022] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0072.022] lstrlenW (lpString=".docx") returned 5 [0072.022] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0072.022] lstrlenW (lpString=".pdf") returned 4 [0072.022] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0072.022] lstrlenW (lpString=".xls") returned 4 [0072.022] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0072.022] lstrlenW (lpString=".xlsx") returned 5 [0072.022] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0072.022] lstrlenW (lpString=".ppt") returned 4 [0072.022] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0072.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.023] lstrlenW (lpString=".zip") returned 4 [0072.023] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0072.023] lstrlenW (lpString=".rar") returned 4 [0072.023] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0072.023] lstrlenW (lpString=".bz2") returned 4 [0072.023] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0072.023] lstrlenW (lpString=".7z") returned 3 [0072.023] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0072.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.023] lstrlenW (lpString=".dbf") returned 4 [0072.023] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0072.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.023] lstrlenW (lpString=".1cd") returned 4 [0072.023] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0072.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0072.023] lstrlenW (lpString=".jpg") returned 4 [0072.023] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0072.023] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.023] lstrlenW (lpString="Garden.jpg") returned 10 [0072.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.024] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=23871) returned 1 [0072.024] CloseHandle (hObject=0x1a4) returned 1 [0072.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0072.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.024] lstrlenW (lpString=".doc") returned 4 [0072.024] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.024] lstrlenW (lpString=".docx") returned 5 [0072.024] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0072.024] lstrlenW (lpString=".pdf") returned 4 [0072.024] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.024] lstrlenW (lpString=".xls") returned 4 [0072.024] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.024] lstrlenW (lpString=".xlsx") returned 5 [0072.024] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0072.024] lstrlenW (lpString=".ppt") returned 4 [0072.024] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.025] lstrlenW (lpString=".zip") returned 4 [0072.025] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.025] lstrlenW (lpString=".rar") returned 4 [0072.025] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.025] lstrlenW (lpString=".bz2") returned 4 [0072.025] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.025] lstrlenW (lpString=".7z") returned 3 [0072.025] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.025] lstrlenW (lpString=".dbf") returned 4 [0072.025] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.025] lstrlenW (lpString=".1cd") returned 4 [0072.179] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.179] lstrlenW (lpString=".jpg") returned 4 [0072.179] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.179] lstrlenW (lpString=".doc") returned 4 [0072.179] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.179] lstrlenW (lpString=".docx") returned 5 [0072.179] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0072.179] lstrlenW (lpString=".pdf") returned 4 [0072.179] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.179] lstrlenW (lpString=".xls") returned 4 [0072.179] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.179] lstrlenW (lpString=".xlsx") returned 5 [0072.179] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0072.179] lstrlenW (lpString=".ppt") returned 4 [0072.179] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.179] lstrlenW (lpString=".zip") returned 4 [0072.179] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.179] lstrlenW (lpString=".rar") returned 4 [0072.179] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.180] lstrlenW (lpString=".bz2") returned 4 [0072.180] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.180] lstrlenW (lpString=".7z") returned 3 [0072.180] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.180] lstrlenW (lpString=".dbf") returned 4 [0072.180] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.180] lstrlenW (lpString=".1cd") returned 4 [0072.180] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0072.180] lstrlenW (lpString=".jpg") returned 4 [0072.180] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.180] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.180] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0072.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0072.395] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=6406) returned 1 [0072.395] CloseHandle (hObject=0x184) returned 1 [0072.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0072.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.395] lstrlenW (lpString=".doc") returned 4 [0072.395] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.395] lstrlenW (lpString=".docx") returned 5 [0072.396] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0072.396] lstrlenW (lpString=".pdf") returned 4 [0072.396] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.396] lstrlenW (lpString=".xls") returned 4 [0072.396] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.396] lstrlenW (lpString=".xlsx") returned 5 [0072.396] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0072.396] lstrlenW (lpString=".ppt") returned 4 [0072.396] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.396] lstrlenW (lpString=".zip") returned 4 [0072.396] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.396] lstrlenW (lpString=".rar") returned 4 [0072.396] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.396] lstrlenW (lpString=".bz2") returned 4 [0072.396] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.396] lstrlenW (lpString=".7z") returned 3 [0072.396] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.396] lstrlenW (lpString=".dbf") returned 4 [0072.396] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.396] lstrlenW (lpString=".1cd") returned 4 [0072.396] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.396] lstrlenW (lpString=".jpg") returned 4 [0072.396] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.397] lstrlenW (lpString=".doc") returned 4 [0072.397] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.397] lstrlenW (lpString=".docx") returned 5 [0072.397] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0072.397] lstrlenW (lpString=".pdf") returned 4 [0072.397] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.397] lstrlenW (lpString=".xls") returned 4 [0072.397] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.397] lstrlenW (lpString=".xlsx") returned 5 [0072.397] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0072.397] lstrlenW (lpString=".ppt") returned 4 [0072.397] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.397] lstrlenW (lpString=".zip") returned 4 [0072.397] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.397] lstrlenW (lpString=".rar") returned 4 [0072.397] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.397] lstrlenW (lpString=".bz2") returned 4 [0072.397] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.397] lstrlenW (lpString=".7z") returned 3 [0072.397] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.397] lstrlenW (lpString=".dbf") returned 4 [0072.397] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.398] lstrlenW (lpString=".1cd") returned 4 [0072.398] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0072.398] lstrlenW (lpString=".jpg") returned 4 [0072.398] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.398] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.398] lstrlenW (lpString="Peacock.jpg") returned 11 [0072.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0072.632] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=5115) returned 1 [0072.632] CloseHandle (hObject=0x1b4) returned 1 [0072.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0072.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.632] lstrlenW (lpString=".doc") returned 4 [0072.632] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.632] lstrlenW (lpString=".docx") returned 5 [0072.632] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0072.633] lstrlenW (lpString=".pdf") returned 4 [0072.633] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.633] lstrlenW (lpString=".xls") returned 4 [0072.633] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.633] lstrlenW (lpString=".xlsx") returned 5 [0072.633] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0072.633] lstrlenW (lpString=".ppt") returned 4 [0072.633] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.633] lstrlenW (lpString=".zip") returned 4 [0072.633] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.633] lstrlenW (lpString=".rar") returned 4 [0072.633] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.633] lstrlenW (lpString=".bz2") returned 4 [0072.633] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.633] lstrlenW (lpString=".7z") returned 3 [0072.633] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.633] lstrlenW (lpString=".dbf") returned 4 [0072.633] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.633] lstrlenW (lpString=".1cd") returned 4 [0072.633] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.633] lstrlenW (lpString=".jpg") returned 4 [0072.633] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.633] lstrlenW (lpString=".doc") returned 4 [0072.633] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.633] lstrlenW (lpString=".docx") returned 5 [0072.633] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0072.633] lstrlenW (lpString=".pdf") returned 4 [0072.634] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.634] lstrlenW (lpString=".xls") returned 4 [0072.634] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.634] lstrlenW (lpString=".xlsx") returned 5 [0072.634] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0072.634] lstrlenW (lpString=".ppt") returned 4 [0072.634] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.634] lstrlenW (lpString=".zip") returned 4 [0072.634] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.634] lstrlenW (lpString=".rar") returned 4 [0072.634] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.634] lstrlenW (lpString=".bz2") returned 4 [0072.634] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.634] lstrlenW (lpString=".7z") returned 3 [0072.634] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.634] lstrlenW (lpString=".dbf") returned 4 [0072.634] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.634] lstrlenW (lpString=".1cd") returned 4 [0072.634] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0072.634] lstrlenW (lpString=".jpg") returned 4 [0072.634] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.634] lstrcmpiW (lpString1=".PNG", lpString2=".beets") returned 1 [0072.634] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0073.242] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=25234) returned 1 [0073.242] CloseHandle (hObject=0x1a4) returned 1 [0073.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0073.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0073.242] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0073.242] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0073.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0073.243] GetLastError () returned 0x0 [0073.243] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x6292, lpOverlapped=0x0) returned 1 [0073.564] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0073.566] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0073.566] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.566] SetEndOfFile (hFile=0x214) returned 1 [0073.566] CloseHandle (hObject=0x214) returned 1 [0073.566] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0073.566] SetEndOfFile (hFile=0x1a4) returned 1 [0073.567] CloseHandle (hObject=0x1a4) returned 1 [0073.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0073.567] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0073.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.567] lstrlenW (lpString=".doc") returned 4 [0073.567] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0073.567] lstrlenW (lpString=".docx") returned 5 [0073.567] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0073.568] lstrlenW (lpString=".pdf") returned 4 [0073.568] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0073.568] lstrlenW (lpString=".xls") returned 4 [0073.568] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0073.568] lstrlenW (lpString=".xlsx") returned 5 [0073.568] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0073.568] lstrlenW (lpString=".ppt") returned 4 [0073.568] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0073.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.568] lstrlenW (lpString=".zip") returned 4 [0073.568] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0073.568] lstrlenW (lpString=".rar") returned 4 [0073.568] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0073.568] lstrlenW (lpString=".bz2") returned 4 [0073.568] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0073.568] lstrlenW (lpString=".7z") returned 3 [0073.568] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0073.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.568] lstrlenW (lpString=".dbf") returned 4 [0073.568] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0073.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.569] lstrlenW (lpString=".1cd") returned 4 [0073.569] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0073.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.569] lstrlenW (lpString=".jpg") returned 4 [0073.569] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0073.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.569] lstrlenW (lpString=".doc") returned 4 [0073.569] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0073.569] lstrlenW (lpString=".docx") returned 5 [0073.569] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0073.569] lstrlenW (lpString=".pdf") returned 4 [0073.569] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0073.569] lstrlenW (lpString=".xls") returned 4 [0073.569] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0073.569] lstrlenW (lpString=".xlsx") returned 5 [0073.569] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0073.569] lstrlenW (lpString=".ppt") returned 4 [0073.569] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0073.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.569] lstrlenW (lpString=".zip") returned 4 [0073.569] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0073.569] lstrlenW (lpString=".rar") returned 4 [0073.569] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0073.569] lstrlenW (lpString=".bz2") returned 4 [0073.569] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0073.569] lstrlenW (lpString=".7z") returned 3 [0073.569] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0073.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.569] lstrlenW (lpString=".dbf") returned 4 [0073.569] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0073.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.569] lstrlenW (lpString=".1cd") returned 4 [0073.570] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0073.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0073.570] lstrlenW (lpString=".jpg") returned 4 [0073.570] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0073.570] lstrcmpiW (lpString1=".PNG", lpString2=".beets") returned 1 [0073.570] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0073.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0073.754] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=20627) returned 1 [0073.754] CloseHandle (hObject=0x214) returned 1 [0073.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0073.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0073.755] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0073.755] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0073.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0073.828] GetLastError () returned 0x0 [0073.828] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x5093, lpOverlapped=0x0) returned 1 [0074.123] WriteFile (hFile=0x1b4, lpBuffer=0x3a80020, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xa70 [0051.642] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x38a0480 [0051.642] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x38b0488 [0051.642] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6303c0 [0051.642] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6330c0 [0051.643] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6303d8 [0051.643] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3b90020 [0051.643] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6303f0 [0051.643] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6303f0, Size=0x20) returned 0x65fe78 [0051.643] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6303f0 [0051.643] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6303f0, Size=0x20) returned 0x65fec8 [0051.643] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0051.643] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0051.643] Wow64DisableWow64FsRedirection (in: OldValue=0x303ff58 | out: OldValue=0x303ff58*=0x0) returned 1 [0051.643] lstrlenW (lpString="kernel32.dll") returned 12 [0051.643] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fe78 | out: hHeap=0x5e0000) returned 1 [0051.643] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0051.643] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fec8 | out: hHeap=0x5e0000) returned 1 [0051.644] Sleep (dwMilliseconds=0x64) [0051.758] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.758] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.758] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.758] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=89168) returned 1 [0051.758] CloseHandle (hObject=0x168) returned 1 [0051.758] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0051.758] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.759] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.759] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.759] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.759] lstrlenW (lpString=".doc") returned 4 [0051.759] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.759] lstrlenW (lpString=".docx") returned 5 [0051.759] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.759] lstrlenW (lpString=".pdf") returned 4 [0051.759] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.759] lstrlenW (lpString=".xls") returned 4 [0051.759] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.759] lstrlenW (lpString=".xlsx") returned 5 [0051.759] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.759] lstrlenW (lpString=".ppt") returned 4 [0051.759] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.759] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.759] lstrlenW (lpString=".zip") returned 4 [0051.759] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.759] lstrlenW (lpString=".rar") returned 4 [0051.759] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.759] lstrlenW (lpString=".bz2") returned 4 [0051.759] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.759] lstrlenW (lpString=".7z") returned 3 [0051.759] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.759] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.759] lstrlenW (lpString=".dbf") returned 4 [0051.759] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.759] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.759] lstrlenW (lpString=".1cd") returned 4 [0051.759] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.759] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.759] lstrlenW (lpString=".jpg") returned 4 [0051.760] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.760] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.760] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.760] lstrlenW (lpString=".doc") returned 4 [0051.760] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.760] lstrlenW (lpString=".docx") returned 5 [0051.760] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.760] lstrlenW (lpString=".pdf") returned 4 [0051.760] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.760] lstrlenW (lpString=".xls") returned 4 [0051.760] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.760] lstrlenW (lpString=".xlsx") returned 5 [0051.760] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.760] lstrlenW (lpString=".ppt") returned 4 [0051.760] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.760] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.760] lstrlenW (lpString=".zip") returned 4 [0051.760] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.760] lstrlenW (lpString=".rar") returned 4 [0051.760] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.760] lstrlenW (lpString=".bz2") returned 4 [0051.760] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.760] lstrlenW (lpString=".7z") returned 3 [0051.760] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.760] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.760] lstrlenW (lpString=".dbf") returned 4 [0051.760] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.760] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.760] lstrlenW (lpString=".1cd") returned 4 [0051.760] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.760] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0051.760] lstrlenW (lpString=".jpg") returned 4 [0051.761] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.761] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.761] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.761] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.761] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=87616) returned 1 [0051.761] CloseHandle (hObject=0x168) returned 1 [0051.761] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0051.761] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.761] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.761] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.761] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.761] lstrlenW (lpString=".doc") returned 4 [0051.761] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.762] lstrlenW (lpString=".docx") returned 5 [0051.762] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.762] lstrlenW (lpString=".pdf") returned 4 [0051.762] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.762] lstrlenW (lpString=".xls") returned 4 [0051.762] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.762] lstrlenW (lpString=".xlsx") returned 5 [0051.762] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.762] lstrlenW (lpString=".ppt") returned 4 [0051.762] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.762] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.762] lstrlenW (lpString=".zip") returned 4 [0051.762] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.762] lstrlenW (lpString=".rar") returned 4 [0051.762] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.762] lstrlenW (lpString=".bz2") returned 4 [0051.762] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.762] lstrlenW (lpString=".7z") returned 3 [0051.762] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.762] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.762] lstrlenW (lpString=".dbf") returned 4 [0051.762] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.762] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.762] lstrlenW (lpString=".1cd") returned 4 [0051.762] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.762] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.762] lstrlenW (lpString=".jpg") returned 4 [0051.762] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.763] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.763] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.763] lstrlenW (lpString=".doc") returned 4 [0051.763] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.763] lstrlenW (lpString=".docx") returned 5 [0051.763] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.763] lstrlenW (lpString=".pdf") returned 4 [0051.763] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.763] lstrlenW (lpString=".xls") returned 4 [0051.763] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.763] lstrlenW (lpString=".xlsx") returned 5 [0051.763] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.763] lstrlenW (lpString=".ppt") returned 4 [0051.763] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.763] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.763] lstrlenW (lpString=".zip") returned 4 [0051.763] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.763] lstrlenW (lpString=".rar") returned 4 [0051.763] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.763] lstrlenW (lpString=".bz2") returned 4 [0051.763] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.763] lstrlenW (lpString=".7z") returned 3 [0051.763] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.763] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.763] lstrlenW (lpString=".dbf") returned 4 [0051.764] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.764] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.764] lstrlenW (lpString=".1cd") returned 4 [0051.764] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.764] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0051.764] lstrlenW (lpString=".jpg") returned 4 [0051.764] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.764] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.764] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.764] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.764] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=91712) returned 1 [0051.764] CloseHandle (hObject=0x168) returned 1 [0051.764] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0051.764] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.765] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.765] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.765] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.765] lstrlenW (lpString=".doc") returned 4 [0051.765] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.765] lstrlenW (lpString=".docx") returned 5 [0051.765] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.765] lstrlenW (lpString=".pdf") returned 4 [0051.765] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.765] lstrlenW (lpString=".xls") returned 4 [0051.765] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.765] lstrlenW (lpString=".xlsx") returned 5 [0051.765] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.765] lstrlenW (lpString=".ppt") returned 4 [0051.765] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.765] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.765] lstrlenW (lpString=".zip") returned 4 [0051.765] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.765] lstrlenW (lpString=".rar") returned 4 [0051.765] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.765] lstrlenW (lpString=".bz2") returned 4 [0051.765] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.765] lstrlenW (lpString=".7z") returned 3 [0051.765] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.765] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.765] lstrlenW (lpString=".dbf") returned 4 [0051.766] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.766] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.766] lstrlenW (lpString=".1cd") returned 4 [0051.766] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.766] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.766] lstrlenW (lpString=".jpg") returned 4 [0051.766] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.766] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.766] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.766] lstrlenW (lpString=".doc") returned 4 [0051.766] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.766] lstrlenW (lpString=".docx") returned 5 [0051.766] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.766] lstrlenW (lpString=".pdf") returned 4 [0051.766] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.766] lstrlenW (lpString=".xls") returned 4 [0051.766] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.766] lstrlenW (lpString=".xlsx") returned 5 [0051.766] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.766] lstrlenW (lpString=".ppt") returned 4 [0051.766] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.766] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.766] lstrlenW (lpString=".zip") returned 4 [0051.766] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.766] lstrlenW (lpString=".rar") returned 4 [0051.766] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.767] lstrlenW (lpString=".bz2") returned 4 [0051.767] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.767] lstrlenW (lpString=".7z") returned 3 [0051.767] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.767] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.767] lstrlenW (lpString=".dbf") returned 4 [0051.767] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.767] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.767] lstrlenW (lpString=".1cd") returned 4 [0051.767] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.767] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0051.767] lstrlenW (lpString=".jpg") returned 4 [0051.767] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.767] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.767] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.767] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.767] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=94800) returned 1 [0051.768] CloseHandle (hObject=0x168) returned 1 [0051.768] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0051.768] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.768] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.768] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.768] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.768] lstrlenW (lpString=".doc") returned 4 [0051.768] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.768] lstrlenW (lpString=".docx") returned 5 [0051.768] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.768] lstrlenW (lpString=".pdf") returned 4 [0051.768] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.768] lstrlenW (lpString=".xls") returned 4 [0051.768] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.769] lstrlenW (lpString=".xlsx") returned 5 [0051.769] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.769] lstrlenW (lpString=".ppt") returned 4 [0051.769] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.769] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.769] lstrlenW (lpString=".zip") returned 4 [0051.769] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.769] lstrlenW (lpString=".rar") returned 4 [0051.769] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.769] lstrlenW (lpString=".bz2") returned 4 [0051.769] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.769] lstrlenW (lpString=".7z") returned 3 [0051.769] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.769] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.769] lstrlenW (lpString=".dbf") returned 4 [0051.769] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.769] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.769] lstrlenW (lpString=".1cd") returned 4 [0051.769] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.769] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.769] lstrlenW (lpString=".jpg") returned 4 [0051.769] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.769] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.769] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.769] lstrlenW (lpString=".doc") returned 4 [0051.769] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.769] lstrlenW (lpString=".docx") returned 5 [0051.769] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.769] lstrlenW (lpString=".pdf") returned 4 [0051.769] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.769] lstrlenW (lpString=".xls") returned 4 [0051.770] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.770] lstrlenW (lpString=".xlsx") returned 5 [0051.770] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.770] lstrlenW (lpString=".ppt") returned 4 [0051.770] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.770] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.770] lstrlenW (lpString=".zip") returned 4 [0051.770] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.770] lstrlenW (lpString=".rar") returned 4 [0051.770] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.770] lstrlenW (lpString=".bz2") returned 4 [0051.770] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.770] lstrlenW (lpString=".7z") returned 3 [0051.770] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.770] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.770] lstrlenW (lpString=".dbf") returned 4 [0051.770] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.770] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.770] lstrlenW (lpString=".1cd") returned 4 [0051.770] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.770] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0051.770] lstrlenW (lpString=".jpg") returned 4 [0051.770] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.771] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.771] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.771] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.771] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=85056) returned 1 [0051.771] CloseHandle (hObject=0x168) returned 1 [0051.771] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0051.771] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.771] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.771] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.771] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.771] lstrlenW (lpString=".doc") returned 4 [0051.771] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.772] lstrlenW (lpString=".docx") returned 5 [0051.772] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.772] lstrlenW (lpString=".pdf") returned 4 [0051.772] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.772] lstrlenW (lpString=".xls") returned 4 [0051.772] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.772] lstrlenW (lpString=".xlsx") returned 5 [0051.772] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.772] lstrlenW (lpString=".ppt") returned 4 [0051.772] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.772] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.772] lstrlenW (lpString=".zip") returned 4 [0051.772] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.772] lstrlenW (lpString=".rar") returned 4 [0051.772] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.772] lstrlenW (lpString=".bz2") returned 4 [0051.772] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.772] lstrlenW (lpString=".7z") returned 3 [0051.772] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.772] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.772] lstrlenW (lpString=".dbf") returned 4 [0051.772] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.772] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.772] lstrlenW (lpString=".1cd") returned 4 [0051.772] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.772] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.772] lstrlenW (lpString=".jpg") returned 4 [0051.773] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.773] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.773] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.773] lstrlenW (lpString=".doc") returned 4 [0051.773] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.773] lstrlenW (lpString=".docx") returned 5 [0051.773] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.773] lstrlenW (lpString=".pdf") returned 4 [0051.773] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.773] lstrlenW (lpString=".xls") returned 4 [0051.773] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.773] lstrlenW (lpString=".xlsx") returned 5 [0051.773] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.773] lstrlenW (lpString=".ppt") returned 4 [0051.773] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.773] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.773] lstrlenW (lpString=".zip") returned 4 [0051.773] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.773] lstrlenW (lpString=".rar") returned 4 [0051.773] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.773] lstrlenW (lpString=".bz2") returned 4 [0051.773] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.773] lstrlenW (lpString=".7z") returned 3 [0051.773] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.773] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.773] lstrlenW (lpString=".dbf") returned 4 [0051.774] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.774] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.774] lstrlenW (lpString=".1cd") returned 4 [0051.774] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.774] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0051.774] lstrlenW (lpString=".jpg") returned 4 [0051.774] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.774] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.774] lstrlenW (lpString="memtest.exe.mui") returned 15 [0051.774] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.774] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=43600) returned 1 [0051.774] CloseHandle (hObject=0x168) returned 1 [0051.774] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0051.775] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.775] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.775] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.775] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.775] lstrlenW (lpString=".doc") returned 4 [0051.775] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.775] lstrlenW (lpString=".docx") returned 5 [0051.775] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.776] lstrlenW (lpString=".pdf") returned 4 [0051.776] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.776] lstrlenW (lpString=".xls") returned 4 [0051.776] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.776] lstrlenW (lpString=".xlsx") returned 5 [0051.776] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.776] lstrlenW (lpString=".ppt") returned 4 [0051.776] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.776] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.776] lstrlenW (lpString=".zip") returned 4 [0051.776] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.776] lstrlenW (lpString=".rar") returned 4 [0051.776] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.776] lstrlenW (lpString=".bz2") returned 4 [0051.776] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.776] lstrlenW (lpString=".7z") returned 3 [0051.776] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.776] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.776] lstrlenW (lpString=".dbf") returned 4 [0051.776] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.776] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.776] lstrlenW (lpString=".1cd") returned 4 [0051.776] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.777] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.777] lstrlenW (lpString=".jpg") returned 4 [0051.777] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.777] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.777] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.777] lstrlenW (lpString=".doc") returned 4 [0051.777] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.777] lstrlenW (lpString=".docx") returned 5 [0051.777] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.777] lstrlenW (lpString=".pdf") returned 4 [0051.777] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.777] lstrlenW (lpString=".xls") returned 4 [0051.777] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.777] lstrlenW (lpString=".xlsx") returned 5 [0051.777] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.777] lstrlenW (lpString=".ppt") returned 4 [0051.777] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.777] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.777] lstrlenW (lpString=".zip") returned 4 [0051.777] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.777] lstrlenW (lpString=".rar") returned 4 [0051.777] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.777] lstrlenW (lpString=".bz2") returned 4 [0051.777] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.777] lstrlenW (lpString=".7z") returned 3 [0051.778] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.778] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.778] lstrlenW (lpString=".dbf") returned 4 [0051.778] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.778] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.778] lstrlenW (lpString=".1cd") returned 4 [0051.778] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.778] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0051.778] lstrlenW (lpString=".jpg") returned 4 [0051.778] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.778] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.778] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.778] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.778] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=90192) returned 1 [0051.778] CloseHandle (hObject=0x168) returned 1 [0051.778] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0051.779] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.779] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.779] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0051.779] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0051.779] lstrlenW (lpString=".doc") returned 4 [0051.779] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.779] lstrlenW (lpString=".docx") returned 5 [0051.779] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.779] lstrlenW (lpString=".pdf") returned 4 [0051.779] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.779] lstrlenW (lpString=".xls") returned 4 [0051.779] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.779] lstrlenW (lpString=".xlsx") returned 5 [0051.779] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.779] lstrlenW (lpString=".ppt") returned 4 [0051.779] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.779] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0051.779] lstrlenW (lpString=".zip") returned 4 [0051.779] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.779] lstrlenW (lpString=".rar") returned 4 [0051.779] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.779] lstrlenW (lpString=".bz2") returned 4 [0051.779] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.779] lstrlenW (lpString=".7z") returned 3 [0051.779] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.781] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=89152) returned 1 [0051.781] CloseHandle (hObject=0x168) returned 1 [0051.781] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0051.782] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.782] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.782] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=3694080) returned 1 [0051.782] CloseHandle (hObject=0x168) returned 1 [0051.782] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0051.782] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.782] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0051.788] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=3876772) returned 1 [0051.788] CloseHandle (hObject=0x168) returned 1 [0051.789] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0051.789] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.789] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0051.789] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2371360) returned 1 [0051.789] CloseHandle (hObject=0x168) returned 1 [0051.789] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0051.789] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.789] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0051.790] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=47452) returned 1 [0051.790] CloseHandle (hObject=0x168) returned 1 [0051.790] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0051.790] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.790] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.791] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=93248) returned 1 [0051.791] CloseHandle (hObject=0x168) returned 1 [0051.791] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0051.791] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.791] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.791] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=90688) returned 1 [0051.791] CloseHandle (hObject=0x168) returned 1 [0051.791] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0051.791] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.792] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.792] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=90704) returned 1 [0051.792] CloseHandle (hObject=0x168) returned 1 [0051.792] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0051.792] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.792] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.793] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=76352) returned 1 [0051.793] CloseHandle (hObject=0x168) returned 1 [0051.793] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0051.793] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.793] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.793] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=75344) returned 1 [0051.793] CloseHandle (hObject=0x168) returned 1 [0051.793] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0051.793] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.793] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.388] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0052.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.390] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.390] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.390] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.791] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.791] ReadFile (in: hFile=0x18c, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.345] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.345] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.345] ReadFile (in: hFile=0x18c, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.745] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.745] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0053.765] SetEndOfFile (hFile=0x18c) returned 1 [0053.766] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3ed1058 [0053.770] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.770] WriteFile (in: hFile=0x18c, lpBuffer=0x3ed1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1058*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.963] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.963] WriteFile (in: hFile=0x18c, lpBuffer=0x3ed1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1058*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.969] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.969] WriteFile (in: hFile=0x18c, lpBuffer=0x3ed1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1058*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.973] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ed1058 | out: hHeap=0x5e0000) returned 1 [0053.973] CloseHandle (hObject=0x18c) returned 1 [0055.870] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.870] lstrlenW (lpString=".doc") returned 4 [0055.870] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.870] lstrlenW (lpString=".docx") returned 5 [0055.870] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.870] lstrlenW (lpString=".pdf") returned 4 [0055.870] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.870] lstrlenW (lpString=".xls") returned 4 [0055.870] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.870] lstrlenW (lpString=".xlsx") returned 5 [0055.870] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.870] lstrlenW (lpString=".ppt") returned 4 [0055.870] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.870] lstrlenW (lpString=".zip") returned 4 [0055.871] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.871] lstrlenW (lpString=".rar") returned 4 [0055.871] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.871] lstrlenW (lpString=".bz2") returned 4 [0055.871] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.871] lstrlenW (lpString=".7z") returned 3 [0055.871] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.871] lstrlenW (lpString=".dbf") returned 4 [0055.871] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.871] lstrlenW (lpString=".1cd") returned 4 [0055.871] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.871] lstrlenW (lpString=".jpg") returned 4 [0055.871] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.871] lstrlenW (lpString=".doc") returned 4 [0055.871] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.871] lstrlenW (lpString=".docx") returned 5 [0055.871] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.871] lstrlenW (lpString=".pdf") returned 4 [0055.871] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.871] lstrlenW (lpString=".xls") returned 4 [0055.871] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.871] lstrlenW (lpString=".xlsx") returned 5 [0055.871] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.872] lstrlenW (lpString=".ppt") returned 4 [0055.872] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.872] lstrlenW (lpString=".zip") returned 4 [0055.872] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.872] lstrlenW (lpString=".rar") returned 4 [0055.872] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.872] lstrlenW (lpString=".bz2") returned 4 [0055.872] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.872] lstrlenW (lpString=".7z") returned 3 [0055.872] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.872] lstrlenW (lpString=".dbf") returned 4 [0055.872] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.872] lstrlenW (lpString=".1cd") returned 4 [0055.872] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0055.872] lstrlenW (lpString=".jpg") returned 4 [0055.872] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.872] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0055.872] lstrlenW (lpString="OutlkLR.cab") returned 11 [0055.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.873] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=14819276) returned 1 [0055.873] CloseHandle (hObject=0x18c) returned 1 [0055.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0055.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.873] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0055.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.874] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.874] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.874] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.940] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.940] ReadFile (in: hFile=0x18c, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.053] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.053] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.053] ReadFile (in: hFile=0x18c, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.008] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.008] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0058.023] SetEndOfFile (hFile=0x18c) returned 1 [0058.023] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f44088 [0058.028] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.029] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.171] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44088*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.173] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f44088 | out: hHeap=0x5e0000) returned 1 [0058.178] CloseHandle (hObject=0x18c) returned 1 [0060.168] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0060.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.168] lstrlenW (lpString=".doc") returned 4 [0060.168] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.168] lstrlenW (lpString=".docx") returned 5 [0060.168] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0060.168] lstrlenW (lpString=".pdf") returned 4 [0060.168] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.168] lstrlenW (lpString=".xls") returned 4 [0060.168] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.168] lstrlenW (lpString=".xlsx") returned 5 [0060.168] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0060.168] lstrlenW (lpString=".ppt") returned 4 [0060.168] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.169] lstrlenW (lpString=".zip") returned 4 [0060.169] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.169] lstrlenW (lpString=".rar") returned 4 [0060.169] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.169] lstrlenW (lpString=".bz2") returned 4 [0060.169] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.169] lstrlenW (lpString=".7z") returned 3 [0060.169] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.169] lstrlenW (lpString=".dbf") returned 4 [0060.169] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.169] lstrlenW (lpString=".1cd") returned 4 [0060.169] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.169] lstrlenW (lpString=".jpg") returned 4 [0060.169] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.169] lstrlenW (lpString=".doc") returned 4 [0060.169] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.170] lstrlenW (lpString=".docx") returned 5 [0060.170] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0060.170] lstrlenW (lpString=".pdf") returned 4 [0060.170] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.170] lstrlenW (lpString=".xls") returned 4 [0060.170] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.170] lstrlenW (lpString=".xlsx") returned 5 [0060.170] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0060.170] lstrlenW (lpString=".ppt") returned 4 [0060.170] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.170] lstrlenW (lpString=".zip") returned 4 [0060.170] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.170] lstrlenW (lpString=".rar") returned 4 [0060.170] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.170] lstrlenW (lpString=".bz2") returned 4 [0060.170] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.170] lstrlenW (lpString=".7z") returned 3 [0060.170] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.170] lstrlenW (lpString=".dbf") returned 4 [0060.170] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.170] lstrlenW (lpString=".1cd") returned 4 [0060.170] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0060.171] lstrlenW (lpString=".jpg") returned 4 [0060.171] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.171] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0060.171] lstrlenW (lpString="Proof.cab") returned 9 [0060.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0060.193] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=13642474) returned 1 [0060.194] CloseHandle (hObject=0x18c) returned 1 [0060.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0060.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.194] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0060.695] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0060.695] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.695] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.695] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.104] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.105] ReadFile (in: hFile=0x18c, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.144] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.145] ReadFile (in: hFile=0x18c, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.231] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.232] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0061.435] SetEndOfFile (hFile=0x18c) returned 1 [0061.435] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f64088 [0061.440] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.440] WriteFile (in: hFile=0x18c, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.441] WriteFile (in: hFile=0x18c, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.442] WriteFile (in: hFile=0x18c, lpBuffer=0x3f64088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64088*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.444] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f64088 | out: hHeap=0x5e0000) returned 1 [0061.446] CloseHandle (hObject=0x18c) returned 1 [0070.192] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.192] lstrlenW (lpString=".doc") returned 4 [0070.192] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.192] lstrlenW (lpString=".docx") returned 5 [0070.192] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0070.192] lstrlenW (lpString=".pdf") returned 4 [0070.192] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.192] lstrlenW (lpString=".xls") returned 4 [0070.192] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.192] lstrlenW (lpString=".xlsx") returned 5 [0070.192] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0070.192] lstrlenW (lpString=".ppt") returned 4 [0070.192] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.192] lstrlenW (lpString=".zip") returned 4 [0070.192] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.192] lstrlenW (lpString=".rar") returned 4 [0070.192] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.192] lstrlenW (lpString=".bz2") returned 4 [0070.192] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.192] lstrlenW (lpString=".7z") returned 3 [0070.192] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.192] lstrlenW (lpString=".dbf") returned 4 [0070.192] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.193] lstrlenW (lpString=".1cd") returned 4 [0070.193] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.193] lstrlenW (lpString=".jpg") returned 4 [0070.193] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.193] lstrlenW (lpString=".doc") returned 4 [0070.193] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString=".docx") returned 5 [0070.193] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0070.193] lstrlenW (lpString=".pdf") returned 4 [0070.193] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString=".xls") returned 4 [0070.193] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString=".xlsx") returned 5 [0070.193] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0070.193] lstrlenW (lpString=".ppt") returned 4 [0070.193] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.193] lstrlenW (lpString=".zip") returned 4 [0070.193] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString=".rar") returned 4 [0070.193] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString=".bz2") returned 4 [0070.193] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.193] lstrlenW (lpString=".7z") returned 3 [0070.193] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.193] lstrlenW (lpString=".dbf") returned 4 [0070.193] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.193] lstrlenW (lpString=".1cd") returned 4 [0070.193] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0070.194] lstrlenW (lpString=".jpg") returned 4 [0070.194] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.194] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0070.194] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0070.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.202] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2511872) returned 1 [0070.202] CloseHandle (hObject=0x190) returned 1 [0070.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0070.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.202] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0070.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.203] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0070.203] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.203] ReadFile (in: hFile=0x190, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.391] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.391] ReadFile (in: hFile=0x190, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.472] ReadFile (in: hFile=0x190, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.500] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.500] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0070.514] SetEndOfFile (hFile=0x190) returned 1 [0070.514] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0070.519] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.520] WriteFile (in: hFile=0x190, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.521] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.521] WriteFile (in: hFile=0x190, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.661] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.661] WriteFile (in: hFile=0x190, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.663] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0070.663] CloseHandle (hObject=0x190) returned 1 [0070.685] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.685] lstrlenW (lpString=".doc") returned 4 [0070.685] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.685] lstrlenW (lpString=".docx") returned 5 [0070.685] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.685] lstrlenW (lpString=".pdf") returned 4 [0070.685] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.685] lstrlenW (lpString=".xls") returned 4 [0070.685] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.685] lstrlenW (lpString=".xlsx") returned 5 [0070.685] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.685] lstrlenW (lpString=".ppt") returned 4 [0070.685] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.686] lstrlenW (lpString=".zip") returned 4 [0070.686] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.686] lstrlenW (lpString=".rar") returned 4 [0070.686] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.686] lstrlenW (lpString=".bz2") returned 4 [0070.686] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.686] lstrlenW (lpString=".7z") returned 3 [0070.686] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.686] lstrlenW (lpString=".dbf") returned 4 [0070.686] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.686] lstrlenW (lpString=".1cd") returned 4 [0070.686] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.686] lstrlenW (lpString=".jpg") returned 4 [0070.686] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.686] lstrlenW (lpString=".doc") returned 4 [0070.686] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.686] lstrlenW (lpString=".docx") returned 5 [0070.686] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.686] lstrlenW (lpString=".pdf") returned 4 [0070.686] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.686] lstrlenW (lpString=".xls") returned 4 [0070.686] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.686] lstrlenW (lpString=".xlsx") returned 5 [0070.686] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.686] lstrlenW (lpString=".ppt") returned 4 [0070.686] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.686] lstrlenW (lpString=".zip") returned 4 [0070.686] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.686] lstrlenW (lpString=".rar") returned 4 [0070.686] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.686] lstrlenW (lpString=".bz2") returned 4 [0070.687] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.687] lstrlenW (lpString=".7z") returned 3 [0070.687] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.687] lstrlenW (lpString=".dbf") returned 4 [0070.687] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.687] lstrlenW (lpString=".1cd") returned 4 [0070.687] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0070.687] lstrlenW (lpString=".jpg") returned 4 [0070.687] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.687] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0070.687] lstrlenW (lpString="GrooveLR.cab") returned 12 [0070.687] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0070.687] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=4095519) returned 1 [0070.687] CloseHandle (hObject=0x1c4) returned 1 [0070.687] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0070.687] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.688] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0070.688] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0070.688] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0070.688] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.688] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.850] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.850] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.028] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.028] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.028] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.058] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.058] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0071.170] SetEndOfFile (hFile=0x1c4) returned 1 [0071.170] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0071.174] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.174] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.175] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.175] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.177] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.177] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.179] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0071.179] CloseHandle (hObject=0x1c4) returned 1 [0071.179] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.179] lstrlenW (lpString=".doc") returned 4 [0071.179] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.179] lstrlenW (lpString=".docx") returned 5 [0071.179] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0071.179] lstrlenW (lpString=".pdf") returned 4 [0071.179] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.179] lstrlenW (lpString=".xls") returned 4 [0071.179] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.179] lstrlenW (lpString=".xlsx") returned 5 [0071.179] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0071.179] lstrlenW (lpString=".ppt") returned 4 [0071.179] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.179] lstrlenW (lpString=".zip") returned 4 [0071.179] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.179] lstrlenW (lpString=".rar") returned 4 [0071.179] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.179] lstrlenW (lpString=".bz2") returned 4 [0071.180] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.180] lstrlenW (lpString=".7z") returned 3 [0071.180] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.180] lstrlenW (lpString=".dbf") returned 4 [0071.180] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.180] lstrlenW (lpString=".1cd") returned 4 [0071.180] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.180] lstrlenW (lpString=".jpg") returned 4 [0071.180] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.180] lstrlenW (lpString=".doc") returned 4 [0071.180] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString=".docx") returned 5 [0071.180] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0071.180] lstrlenW (lpString=".pdf") returned 4 [0071.180] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString=".xls") returned 4 [0071.180] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString=".xlsx") returned 5 [0071.180] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0071.180] lstrlenW (lpString=".ppt") returned 4 [0071.180] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.180] lstrlenW (lpString=".zip") returned 4 [0071.180] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString=".rar") returned 4 [0071.180] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString=".bz2") returned 4 [0071.180] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.180] lstrlenW (lpString=".7z") returned 3 [0071.180] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.180] lstrlenW (lpString=".dbf") returned 4 [0071.180] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.180] lstrlenW (lpString=".1cd") returned 4 [0071.180] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0071.181] lstrlenW (lpString=".jpg") returned 4 [0071.181] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.181] lstrcmpiW (lpString1=".dll", lpString2=".beets") returned 1 [0071.181] lstrlenW (lpString="msvcr90.dll") returned 11 [0071.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.203] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=655872) returned 1 [0071.203] CloseHandle (hObject=0x16c) returned 1 [0071.203] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0071.203] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.203] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.203] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.203] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.203] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0071.204] GetLastError () returned 0x0 [0071.204] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0071.542] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0071.555] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.555] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.556] SetEndOfFile (hFile=0x1b4) returned 1 [0071.556] CloseHandle (hObject=0x1b4) returned 1 [0071.556] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.556] SetEndOfFile (hFile=0x16c) returned 1 [0071.559] CloseHandle (hObject=0x16c) returned 1 [0071.559] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.560] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0071.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.560] lstrlenW (lpString=".doc") returned 4 [0071.560] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.560] lstrlenW (lpString=".docx") returned 5 [0071.560] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0071.560] lstrlenW (lpString=".pdf") returned 4 [0071.560] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.560] lstrlenW (lpString=".xls") returned 4 [0071.560] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.560] lstrlenW (lpString=".xlsx") returned 5 [0071.560] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0071.560] lstrlenW (lpString=".ppt") returned 4 [0071.560] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.560] lstrlenW (lpString=".zip") returned 4 [0071.560] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.560] lstrlenW (lpString=".rar") returned 4 [0071.560] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.560] lstrlenW (lpString=".bz2") returned 4 [0071.560] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.560] lstrlenW (lpString=".7z") returned 3 [0071.560] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.560] lstrlenW (lpString=".dbf") returned 4 [0071.561] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.561] lstrlenW (lpString=".1cd") returned 4 [0071.561] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.561] lstrlenW (lpString=".jpg") returned 4 [0071.561] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.561] lstrlenW (lpString=".doc") returned 4 [0071.561] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.561] lstrlenW (lpString=".docx") returned 5 [0071.561] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0071.561] lstrlenW (lpString=".pdf") returned 4 [0071.561] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.561] lstrlenW (lpString=".xls") returned 4 [0071.561] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.561] lstrlenW (lpString=".xlsx") returned 5 [0071.561] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0071.561] lstrlenW (lpString=".ppt") returned 4 [0071.561] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.561] lstrlenW (lpString=".zip") returned 4 [0071.561] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.561] lstrlenW (lpString=".rar") returned 4 [0071.561] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.561] lstrlenW (lpString=".bz2") returned 4 [0071.561] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.561] lstrlenW (lpString=".7z") returned 3 [0071.562] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.562] lstrlenW (lpString=".dbf") returned 4 [0071.562] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.562] lstrlenW (lpString=".1cd") returned 4 [0071.562] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0071.562] lstrlenW (lpString=".jpg") returned 4 [0071.562] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.562] lstrcmpiW (lpString1=".dll", lpString2=".beets") returned 1 [0071.562] lstrlenW (lpString="osetupui.dll") returned 12 [0071.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.563] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=191872) returned 1 [0071.563] CloseHandle (hObject=0x16c) returned 1 [0071.563] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0071.563] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.563] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.563] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0071.563] GetLastError () returned 0x0 [0071.564] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0071.845] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0071.851] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.851] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.851] SetEndOfFile (hFile=0x1b4) returned 1 [0071.851] CloseHandle (hObject=0x1b4) returned 1 [0071.851] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.851] SetEndOfFile (hFile=0x16c) returned 1 [0071.852] CloseHandle (hObject=0x16c) returned 1 [0071.852] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.853] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0071.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.853] lstrlenW (lpString=".doc") returned 4 [0071.853] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.853] lstrlenW (lpString=".docx") returned 5 [0071.853] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0071.853] lstrlenW (lpString=".pdf") returned 4 [0071.853] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.853] lstrlenW (lpString=".xls") returned 4 [0071.853] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.853] lstrlenW (lpString=".xlsx") returned 5 [0071.853] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0071.853] lstrlenW (lpString=".ppt") returned 4 [0071.853] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.853] lstrlenW (lpString=".zip") returned 4 [0071.853] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.853] lstrlenW (lpString=".rar") returned 4 [0071.853] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.853] lstrlenW (lpString=".bz2") returned 4 [0071.853] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.854] lstrlenW (lpString=".7z") returned 3 [0071.854] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.854] lstrlenW (lpString=".dbf") returned 4 [0071.854] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.854] lstrlenW (lpString=".1cd") returned 4 [0071.854] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.854] lstrlenW (lpString=".jpg") returned 4 [0071.854] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.854] lstrlenW (lpString=".doc") returned 4 [0071.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.854] lstrlenW (lpString=".docx") returned 5 [0071.854] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0071.854] lstrlenW (lpString=".pdf") returned 4 [0071.854] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.854] lstrlenW (lpString=".xls") returned 4 [0071.854] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.854] lstrlenW (lpString=".xlsx") returned 5 [0071.854] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0071.854] lstrlenW (lpString=".ppt") returned 4 [0071.854] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.854] lstrlenW (lpString=".zip") returned 4 [0071.854] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.854] lstrlenW (lpString=".rar") returned 4 [0071.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.855] lstrlenW (lpString=".bz2") returned 4 [0071.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.855] lstrlenW (lpString=".7z") returned 3 [0071.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.855] lstrlenW (lpString=".dbf") returned 4 [0071.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.855] lstrlenW (lpString=".1cd") returned 4 [0071.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0071.855] lstrlenW (lpString=".jpg") returned 4 [0071.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.855] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0071.855] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0071.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.856] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=868864) returned 1 [0071.856] CloseHandle (hObject=0x16c) returned 1 [0071.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0071.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.856] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.856] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0071.856] GetLastError () returned 0x0 [0071.856] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0071.932] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0071.963] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.963] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0071.963] SetEndOfFile (hFile=0x1b4) returned 1 [0071.964] CloseHandle (hObject=0x1b4) returned 1 [0071.964] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.964] SetEndOfFile (hFile=0x16c) returned 1 [0071.967] CloseHandle (hObject=0x16c) returned 1 [0071.967] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.967] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0071.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.967] lstrlenW (lpString=".doc") returned 4 [0071.967] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.967] lstrlenW (lpString=".docx") returned 5 [0071.967] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0071.967] lstrlenW (lpString=".pdf") returned 4 [0071.967] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.967] lstrlenW (lpString=".xls") returned 4 [0071.967] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.967] lstrlenW (lpString=".xlsx") returned 5 [0071.967] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0071.968] lstrlenW (lpString=".ppt") returned 4 [0071.968] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.968] lstrlenW (lpString=".zip") returned 4 [0071.968] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.968] lstrlenW (lpString=".rar") returned 4 [0071.968] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.968] lstrlenW (lpString=".bz2") returned 4 [0071.968] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.968] lstrlenW (lpString=".7z") returned 3 [0071.968] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.968] lstrlenW (lpString=".dbf") returned 4 [0071.968] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.968] lstrlenW (lpString=".1cd") returned 4 [0071.968] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.968] lstrlenW (lpString=".jpg") returned 4 [0071.968] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.968] lstrlenW (lpString=".doc") returned 4 [0071.968] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.968] lstrlenW (lpString=".docx") returned 5 [0071.968] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0071.968] lstrlenW (lpString=".pdf") returned 4 [0071.968] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.968] lstrlenW (lpString=".xls") returned 4 [0071.968] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.968] lstrlenW (lpString=".xlsx") returned 5 [0071.968] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0071.969] lstrlenW (lpString=".ppt") returned 4 [0071.969] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.969] lstrlenW (lpString=".zip") returned 4 [0071.969] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.969] lstrlenW (lpString=".rar") returned 4 [0071.969] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.969] lstrlenW (lpString=".bz2") returned 4 [0071.969] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.969] lstrlenW (lpString=".7z") returned 3 [0071.969] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.969] lstrlenW (lpString=".dbf") returned 4 [0071.969] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.969] lstrlenW (lpString=".1cd") returned 4 [0071.969] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0071.969] lstrlenW (lpString=".jpg") returned 4 [0071.969] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.969] lstrcmpiW (lpString1=".exe", lpString2=".beets") returned 1 [0071.969] lstrlenW (lpString="ose.exe") returned 7 [0071.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.970] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=174440) returned 1 [0071.970] CloseHandle (hObject=0x16c) returned 1 [0071.970] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0071.970] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.970] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.970] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.970] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.970] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0071.970] GetLastError () returned 0x0 [0071.970] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0072.203] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0072.333] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.333] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0072.333] SetEndOfFile (hFile=0x1b4) returned 1 [0072.333] CloseHandle (hObject=0x1b4) returned 1 [0072.333] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.333] SetEndOfFile (hFile=0x16c) returned 1 [0072.334] CloseHandle (hObject=0x16c) returned 1 [0072.334] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0072.335] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0072.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.335] lstrlenW (lpString=".doc") returned 4 [0072.335] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.335] lstrlenW (lpString=".docx") returned 5 [0072.335] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0072.335] lstrlenW (lpString=".pdf") returned 4 [0072.335] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.335] lstrlenW (lpString=".xls") returned 4 [0072.335] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.335] lstrlenW (lpString=".xlsx") returned 5 [0072.336] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0072.336] lstrlenW (lpString=".ppt") returned 4 [0072.336] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.336] lstrlenW (lpString=".zip") returned 4 [0072.336] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.336] lstrlenW (lpString=".rar") returned 4 [0072.336] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.336] lstrlenW (lpString=".bz2") returned 4 [0072.336] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.336] lstrlenW (lpString=".7z") returned 3 [0072.336] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.336] lstrlenW (lpString=".dbf") returned 4 [0072.336] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.336] lstrlenW (lpString=".1cd") returned 4 [0072.336] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.336] lstrlenW (lpString=".jpg") returned 4 [0072.336] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.336] lstrlenW (lpString=".doc") returned 4 [0072.336] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.336] lstrlenW (lpString=".docx") returned 5 [0072.336] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0072.336] lstrlenW (lpString=".pdf") returned 4 [0072.336] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.337] lstrlenW (lpString=".xls") returned 4 [0072.337] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.337] lstrlenW (lpString=".xlsx") returned 5 [0072.337] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0072.337] lstrlenW (lpString=".ppt") returned 4 [0072.337] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.337] lstrlenW (lpString=".zip") returned 4 [0072.337] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.337] lstrlenW (lpString=".rar") returned 4 [0072.337] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.337] lstrlenW (lpString=".bz2") returned 4 [0072.337] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.337] lstrlenW (lpString=".7z") returned 3 [0072.337] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.337] lstrlenW (lpString=".dbf") returned 4 [0072.337] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.337] lstrlenW (lpString=".1cd") returned 4 [0072.337] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0072.337] lstrlenW (lpString=".jpg") returned 4 [0072.337] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.337] lstrcmpiW (lpString1=".xrm-ms", lpString2=".beets") returned 1 [0072.338] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0072.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0072.338] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=715834) returned 1 [0072.338] CloseHandle (hObject=0x16c) returned 1 [0072.338] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0072.338] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0072.338] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.338] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0072.339] GetLastError () returned 0x0 [0072.339] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0072.574] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0072.586] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.586] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x104, lpOverlapped=0x0) returned 1 [0072.586] SetEndOfFile (hFile=0x1b4) returned 1 [0072.587] CloseHandle (hObject=0x1b4) returned 1 [0072.587] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.587] SetEndOfFile (hFile=0x16c) returned 1 [0072.589] CloseHandle (hObject=0x16c) returned 1 [0072.590] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0072.590] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0072.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.590] lstrlenW (lpString=".doc") returned 4 [0072.590] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0072.590] lstrlenW (lpString=".docx") returned 5 [0072.590] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0072.590] lstrlenW (lpString=".pdf") returned 4 [0072.590] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0072.590] lstrlenW (lpString=".xls") returned 4 [0072.590] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0072.590] lstrlenW (lpString=".xlsx") returned 5 [0072.591] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0072.591] lstrlenW (lpString=".ppt") returned 4 [0072.591] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0072.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.591] lstrlenW (lpString=".zip") returned 4 [0072.591] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0072.591] lstrlenW (lpString=".rar") returned 4 [0072.591] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0072.591] lstrlenW (lpString=".bz2") returned 4 [0072.591] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0072.591] lstrlenW (lpString=".7z") returned 3 [0072.591] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0072.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.591] lstrlenW (lpString=".dbf") returned 4 [0072.591] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0072.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.591] lstrlenW (lpString=".1cd") returned 4 [0072.591] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0072.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.591] lstrlenW (lpString=".jpg") returned 4 [0072.591] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0072.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.591] lstrlenW (lpString=".doc") returned 4 [0072.591] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0072.591] lstrlenW (lpString=".docx") returned 5 [0072.591] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0072.591] lstrlenW (lpString=".pdf") returned 4 [0072.591] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0072.592] lstrlenW (lpString=".xls") returned 4 [0072.592] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0072.592] lstrlenW (lpString=".xlsx") returned 5 [0072.592] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0072.592] lstrlenW (lpString=".ppt") returned 4 [0072.592] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0072.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.592] lstrlenW (lpString=".zip") returned 4 [0072.592] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0072.592] lstrlenW (lpString=".rar") returned 4 [0072.592] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0072.592] lstrlenW (lpString=".bz2") returned 4 [0072.592] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0072.592] lstrlenW (lpString=".7z") returned 3 [0072.592] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0072.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.592] lstrlenW (lpString=".dbf") returned 4 [0072.592] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0072.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.592] lstrlenW (lpString=".1cd") returned 4 [0072.592] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0072.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0072.592] lstrlenW (lpString=".jpg") returned 4 [0072.592] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0072.592] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0072.593] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0072.593] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0072.593] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=27532288) returned 1 [0072.593] CloseHandle (hObject=0x16c) returned 1 [0072.593] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0072.593] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.593] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0072.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0072.594] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0072.594] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.594] ReadFile (in: hFile=0x16c, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.813] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.813] ReadFile (in: hFile=0x16c, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.196] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.196] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.196] ReadFile (in: hFile=0x16c, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.535] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.535] WriteFile (in: hFile=0x16c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0073.544] SetEndOfFile (hFile=0x16c) returned 1 [0073.545] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0073.545] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.545] WriteFile (in: hFile=0x16c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.546] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.546] WriteFile (in: hFile=0x16c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.548] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0073.548] WriteFile (in: hFile=0x16c, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.550] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0073.550] CloseHandle (hObject=0x16c) returned 1 [0073.550] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0073.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.550] lstrlenW (lpString=".doc") returned 4 [0073.550] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.550] lstrlenW (lpString=".docx") returned 5 [0073.550] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0073.550] lstrlenW (lpString=".pdf") returned 4 [0073.550] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.550] lstrlenW (lpString=".xls") returned 4 [0073.550] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.550] lstrlenW (lpString=".xlsx") returned 5 [0073.551] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0073.551] lstrlenW (lpString=".ppt") returned 4 [0073.551] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.551] lstrlenW (lpString=".zip") returned 4 [0073.551] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.551] lstrlenW (lpString=".rar") returned 4 [0073.551] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.551] lstrlenW (lpString=".bz2") returned 4 [0073.551] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.551] lstrlenW (lpString=".7z") returned 3 [0073.551] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.551] lstrlenW (lpString=".dbf") returned 4 [0073.551] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.551] lstrlenW (lpString=".1cd") returned 4 [0073.551] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.551] lstrlenW (lpString=".jpg") returned 4 [0073.551] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.551] lstrlenW (lpString=".doc") returned 4 [0073.551] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.551] lstrlenW (lpString=".docx") returned 5 [0073.551] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0073.552] lstrlenW (lpString=".pdf") returned 4 [0073.552] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.552] lstrlenW (lpString=".xls") returned 4 [0073.552] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.552] lstrlenW (lpString=".xlsx") returned 5 [0073.552] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0073.552] lstrlenW (lpString=".ppt") returned 4 [0073.552] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.552] lstrlenW (lpString=".zip") returned 4 [0073.552] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.552] lstrlenW (lpString=".rar") returned 4 [0073.552] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.552] lstrlenW (lpString=".bz2") returned 4 [0073.552] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.552] lstrlenW (lpString=".7z") returned 3 [0073.552] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.552] lstrlenW (lpString=".dbf") returned 4 [0073.552] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.552] lstrlenW (lpString=".1cd") returned 4 [0073.552] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0073.552] lstrlenW (lpString=".jpg") returned 4 [0073.552] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.552] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0073.552] lstrlenW (lpString="Office32WW.msi") returned 14 [0073.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0073.580] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1992192) returned 1 [0073.580] CloseHandle (hObject=0x1a4) returned 1 [0073.580] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0073.580] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.580] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0073.581] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0073.581] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0073.581] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.581] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.810] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.810] ReadFile (in: hFile=0x1a4, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.119] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.120] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.120] ReadFile (hFile=0x1a4, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0) Thread: id = 16 os_tid = 0xa74 [0051.644] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x38c06a0 [0051.644] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x38d06a8 [0051.645] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6303f0 [0051.645] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6330d0 [0051.645] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630408 [0051.645] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3ca0020 [0051.645] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630420 [0051.645] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630420, Size=0x20) returned 0x65fec8 [0051.645] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630420 [0051.645] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630420, Size=0x20) returned 0x65fe78 [0051.645] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0051.646] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0051.646] Wow64DisableWow64FsRedirection (in: OldValue=0x317ff58 | out: OldValue=0x317ff58*=0x0) returned 1 [0051.646] lstrlenW (lpString="kernel32.dll") returned 12 [0051.646] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fec8 | out: hHeap=0x5e0000) returned 1 [0051.646] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0051.646] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fe78 | out: hHeap=0x5e0000) returned 1 [0051.646] Sleep (dwMilliseconds=0x64) [0051.784] Sleep (dwMilliseconds=0x64) [0052.242] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0052.242] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0052.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.247] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1565) returned 1 [0052.247] CloseHandle (hObject=0x160) returned 1 [0052.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0052.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.248] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.248] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.250] GetLastError () returned 0x0 [0052.250] ReadFile (in: hFile=0x160, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x61d, lpOverlapped=0x0) returned 1 [0052.272] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x620, lpOverlapped=0x0) returned 1 [0052.274] ReadFile (in: hFile=0x160, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.274] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.274] SetEndOfFile (hFile=0x168) returned 1 [0052.274] CloseHandle (hObject=0x168) returned 1 [0052.276] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.276] SetEndOfFile (hFile=0x160) returned 1 [0052.277] CloseHandle (hObject=0x160) returned 1 [0052.277] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0052.277] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0052.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.278] lstrlenW (lpString=".doc") returned 4 [0052.278] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.278] lstrlenW (lpString=".docx") returned 5 [0052.278] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0052.278] lstrlenW (lpString=".pdf") returned 4 [0052.278] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.278] lstrlenW (lpString=".xls") returned 4 [0052.278] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.278] lstrlenW (lpString=".xlsx") returned 5 [0052.278] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0052.278] lstrlenW (lpString=".ppt") returned 4 [0052.278] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.278] lstrlenW (lpString=".zip") returned 4 [0052.278] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.278] lstrlenW (lpString=".rar") returned 4 [0052.278] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.278] lstrlenW (lpString=".bz2") returned 4 [0052.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.278] lstrlenW (lpString=".7z") returned 3 [0052.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.279] lstrlenW (lpString=".dbf") returned 4 [0052.279] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.279] lstrlenW (lpString=".1cd") returned 4 [0052.279] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.279] lstrlenW (lpString=".jpg") returned 4 [0052.279] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.279] lstrlenW (lpString=".doc") returned 4 [0052.279] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.279] lstrlenW (lpString=".docx") returned 5 [0052.279] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0052.279] lstrlenW (lpString=".pdf") returned 4 [0052.279] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.279] lstrlenW (lpString=".xls") returned 4 [0052.279] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.279] lstrlenW (lpString=".xlsx") returned 5 [0052.279] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0052.279] lstrlenW (lpString=".ppt") returned 4 [0052.279] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.279] lstrlenW (lpString=".zip") returned 4 [0052.279] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.279] lstrlenW (lpString=".rar") returned 4 [0052.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.280] lstrlenW (lpString=".bz2") returned 4 [0052.280] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.280] lstrlenW (lpString=".7z") returned 3 [0052.280] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.280] lstrlenW (lpString=".dbf") returned 4 [0052.280] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.280] lstrlenW (lpString=".1cd") returned 4 [0052.280] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0052.280] lstrlenW (lpString=".jpg") returned 4 [0052.280] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.280] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0052.280] lstrlenW (lpString="Setup.xml") returned 9 [0052.280] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.281] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2296) returned 1 [0052.281] CloseHandle (hObject=0x160) returned 1 [0052.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0052.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.282] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.282] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.282] GetLastError () returned 0x0 [0052.282] ReadFile (in: hFile=0x160, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0052.308] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x900, lpOverlapped=0x0) returned 1 [0052.309] ReadFile (in: hFile=0x160, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.309] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.309] SetEndOfFile (hFile=0x168) returned 1 [0052.309] CloseHandle (hObject=0x168) returned 1 [0052.312] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.312] SetEndOfFile (hFile=0x160) returned 1 [0052.313] CloseHandle (hObject=0x160) returned 1 [0052.314] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0052.314] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0052.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.314] lstrlenW (lpString=".doc") returned 4 [0052.314] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.314] lstrlenW (lpString=".docx") returned 5 [0052.314] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0052.314] lstrlenW (lpString=".pdf") returned 4 [0052.315] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString=".xls") returned 4 [0052.315] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString=".xlsx") returned 5 [0052.315] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0052.315] lstrlenW (lpString=".ppt") returned 4 [0052.315] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.315] lstrlenW (lpString=".zip") returned 4 [0052.315] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.315] lstrlenW (lpString=".rar") returned 4 [0052.315] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString=".bz2") returned 4 [0052.315] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString=".7z") returned 3 [0052.315] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.315] lstrlenW (lpString=".dbf") returned 4 [0052.315] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.315] lstrlenW (lpString=".1cd") returned 4 [0052.315] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.315] lstrlenW (lpString=".jpg") returned 4 [0052.315] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.315] lstrlenW (lpString=".doc") returned 4 [0052.315] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.315] lstrlenW (lpString=".docx") returned 5 [0052.316] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0052.316] lstrlenW (lpString=".pdf") returned 4 [0052.316] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.316] lstrlenW (lpString=".xls") returned 4 [0052.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.316] lstrlenW (lpString=".xlsx") returned 5 [0052.316] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0052.316] lstrlenW (lpString=".ppt") returned 4 [0052.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.316] lstrlenW (lpString=".zip") returned 4 [0052.316] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.316] lstrlenW (lpString=".rar") returned 4 [0052.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.316] lstrlenW (lpString=".bz2") returned 4 [0052.316] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.316] lstrlenW (lpString=".7z") returned 3 [0052.316] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.316] lstrlenW (lpString=".dbf") returned 4 [0052.316] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.316] lstrlenW (lpString=".1cd") returned 4 [0052.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0052.316] lstrlenW (lpString=".jpg") returned 4 [0052.316] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.317] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0052.317] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0052.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.317] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1450) returned 1 [0052.317] CloseHandle (hObject=0x160) returned 1 [0052.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0052.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.318] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.319] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.319] GetLastError () returned 0x0 [0052.319] ReadFile (in: hFile=0x160, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0052.774] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0052.775] ReadFile (in: hFile=0x160, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.775] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0052.775] SetEndOfFile (hFile=0x168) returned 1 [0052.775] CloseHandle (hObject=0x168) returned 1 [0052.780] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.780] SetEndOfFile (hFile=0x160) returned 1 [0052.781] CloseHandle (hObject=0x160) returned 1 [0052.781] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0052.781] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0052.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.782] lstrlenW (lpString=".doc") returned 4 [0052.782] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.782] lstrlenW (lpString=".docx") returned 5 [0052.782] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0052.782] lstrlenW (lpString=".pdf") returned 4 [0052.782] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.782] lstrlenW (lpString=".xls") returned 4 [0052.782] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.782] lstrlenW (lpString=".xlsx") returned 5 [0052.782] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0052.782] lstrlenW (lpString=".ppt") returned 4 [0052.782] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.782] lstrlenW (lpString=".zip") returned 4 [0052.782] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.782] lstrlenW (lpString=".rar") returned 4 [0052.782] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.782] lstrlenW (lpString=".bz2") returned 4 [0052.782] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.782] lstrlenW (lpString=".7z") returned 3 [0052.782] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.782] lstrlenW (lpString=".dbf") returned 4 [0052.782] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.782] lstrlenW (lpString=".1cd") returned 4 [0052.782] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.782] lstrlenW (lpString=".jpg") returned 4 [0052.782] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.783] lstrlenW (lpString=".doc") returned 4 [0052.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.783] lstrlenW (lpString=".docx") returned 5 [0052.783] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0052.783] lstrlenW (lpString=".pdf") returned 4 [0052.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.783] lstrlenW (lpString=".xls") returned 4 [0052.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.783] lstrlenW (lpString=".xlsx") returned 5 [0052.783] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0052.783] lstrlenW (lpString=".ppt") returned 4 [0052.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.783] lstrlenW (lpString=".zip") returned 4 [0052.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.783] lstrlenW (lpString=".rar") returned 4 [0052.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.783] lstrlenW (lpString=".bz2") returned 4 [0052.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.783] lstrlenW (lpString=".7z") returned 3 [0052.783] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.783] lstrlenW (lpString=".dbf") returned 4 [0052.783] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.783] lstrlenW (lpString=".1cd") returned 4 [0052.783] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0052.784] lstrlenW (lpString=".jpg") returned 4 [0052.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.784] Sleep (dwMilliseconds=0x64) [0053.047] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.047] lstrlenW (lpString="Setup.xml") returned 9 [0053.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.047] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2424) returned 1 [0053.047] CloseHandle (hObject=0x190) returned 1 [0053.048] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.048] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.048] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.048] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0053.107] GetLastError () returned 0x0 [0053.108] ReadFile (in: hFile=0x190, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x978, lpOverlapped=0x0) returned 1 [0053.576] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x980, lpOverlapped=0x0) returned 1 [0053.577] ReadFile (in: hFile=0x190, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.577] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.577] SetEndOfFile (hFile=0x1a0) returned 1 [0053.577] CloseHandle (hObject=0x1a0) returned 1 [0053.580] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.580] SetEndOfFile (hFile=0x190) returned 1 [0053.581] CloseHandle (hObject=0x190) returned 1 [0053.581] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0053.581] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0053.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.582] lstrlenW (lpString=".doc") returned 4 [0053.582] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.582] lstrlenW (lpString=".docx") returned 5 [0053.582] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0053.582] lstrlenW (lpString=".pdf") returned 4 [0053.582] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.582] lstrlenW (lpString=".xls") returned 4 [0053.582] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.582] lstrlenW (lpString=".xlsx") returned 5 [0053.582] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0053.582] lstrlenW (lpString=".ppt") returned 4 [0053.582] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.582] lstrlenW (lpString=".zip") returned 4 [0053.582] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.582] lstrlenW (lpString=".rar") returned 4 [0053.582] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.582] lstrlenW (lpString=".bz2") returned 4 [0053.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.582] lstrlenW (lpString=".7z") returned 3 [0053.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.582] lstrlenW (lpString=".dbf") returned 4 [0053.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.582] lstrlenW (lpString=".1cd") returned 4 [0053.582] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.582] lstrlenW (lpString=".jpg") returned 4 [0053.583] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.583] lstrlenW (lpString=".doc") returned 4 [0053.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.583] lstrlenW (lpString=".docx") returned 5 [0053.583] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0053.583] lstrlenW (lpString=".pdf") returned 4 [0053.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.583] lstrlenW (lpString=".xls") returned 4 [0053.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.583] lstrlenW (lpString=".xlsx") returned 5 [0053.583] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0053.583] lstrlenW (lpString=".ppt") returned 4 [0053.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.583] lstrlenW (lpString=".zip") returned 4 [0053.583] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.583] lstrlenW (lpString=".rar") returned 4 [0053.583] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.583] lstrlenW (lpString=".bz2") returned 4 [0053.583] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.583] lstrlenW (lpString=".7z") returned 3 [0053.583] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.583] lstrlenW (lpString=".dbf") returned 4 [0053.583] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.584] lstrlenW (lpString=".1cd") returned 4 [0053.584] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0053.584] lstrlenW (lpString=".jpg") returned 4 [0053.584] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.584] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0053.584] lstrlenW (lpString="Proof.xml") returned 9 [0053.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.584] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1458) returned 1 [0053.584] CloseHandle (hObject=0x190) returned 1 [0053.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0053.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0053.585] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.585] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.585] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.585] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0053.585] GetLastError () returned 0x0 [0053.585] ReadFile (in: hFile=0x190, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0054.064] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0054.065] ReadFile (in: hFile=0x190, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.065] SetEndOfFile (hFile=0x1a0) returned 1 [0054.065] CloseHandle (hObject=0x1a0) returned 1 [0054.066] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.066] SetEndOfFile (hFile=0x190) returned 1 [0054.067] CloseHandle (hObject=0x190) returned 1 [0054.067] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.068] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0054.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.068] lstrlenW (lpString=".doc") returned 4 [0054.068] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.068] lstrlenW (lpString=".docx") returned 5 [0054.068] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0054.068] lstrlenW (lpString=".pdf") returned 4 [0054.068] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.068] lstrlenW (lpString=".xls") returned 4 [0054.068] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.068] lstrlenW (lpString=".xlsx") returned 5 [0054.068] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0054.068] lstrlenW (lpString=".ppt") returned 4 [0054.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.068] lstrlenW (lpString=".zip") returned 4 [0054.068] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.068] lstrlenW (lpString=".rar") returned 4 [0054.069] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.069] lstrlenW (lpString=".bz2") returned 4 [0054.069] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.069] lstrlenW (lpString=".7z") returned 3 [0054.069] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.069] lstrlenW (lpString=".dbf") returned 4 [0054.069] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.069] lstrlenW (lpString=".1cd") returned 4 [0054.069] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.069] lstrlenW (lpString=".jpg") returned 4 [0054.069] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.069] lstrlenW (lpString=".doc") returned 4 [0054.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.069] lstrlenW (lpString=".docx") returned 5 [0054.069] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0054.069] lstrlenW (lpString=".pdf") returned 4 [0054.070] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.070] lstrlenW (lpString=".xls") returned 4 [0054.070] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.070] lstrlenW (lpString=".xlsx") returned 5 [0054.070] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0054.070] lstrlenW (lpString=".ppt") returned 4 [0054.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.070] lstrlenW (lpString=".zip") returned 4 [0054.070] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.070] lstrlenW (lpString=".rar") returned 4 [0054.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.070] lstrlenW (lpString=".bz2") returned 4 [0054.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.070] lstrlenW (lpString=".7z") returned 3 [0054.070] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.070] lstrlenW (lpString=".dbf") returned 4 [0054.070] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.070] lstrlenW (lpString=".1cd") returned 4 [0054.070] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0054.070] lstrlenW (lpString=".jpg") returned 4 [0054.070] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.070] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.071] lstrlenW (lpString="VisioMUI.xml") returned 12 [0054.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.071] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=9503) returned 1 [0054.071] CloseHandle (hObject=0x190) returned 1 [0054.071] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0054.071] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0054.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.071] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.071] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0054.072] GetLastError () returned 0x0 [0054.072] ReadFile (in: hFile=0x190, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x251f, lpOverlapped=0x0) returned 1 [0054.262] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0054.263] ReadFile (in: hFile=0x190, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.263] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.263] SetEndOfFile (hFile=0x1a0) returned 1 [0054.263] CloseHandle (hObject=0x1a0) returned 1 [0054.268] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.268] SetEndOfFile (hFile=0x190) returned 1 [0054.271] CloseHandle (hObject=0x190) returned 1 [0054.271] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0054.272] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0054.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.272] lstrlenW (lpString=".doc") returned 4 [0054.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.272] lstrlenW (lpString=".docx") returned 5 [0054.272] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.272] lstrlenW (lpString=".pdf") returned 4 [0054.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.272] lstrlenW (lpString=".xls") returned 4 [0054.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.272] lstrlenW (lpString=".xlsx") returned 5 [0054.272] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.272] lstrlenW (lpString=".ppt") returned 4 [0054.273] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.273] lstrlenW (lpString=".zip") returned 4 [0054.273] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.273] lstrlenW (lpString=".rar") returned 4 [0054.273] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.273] lstrlenW (lpString=".bz2") returned 4 [0054.273] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.273] lstrlenW (lpString=".7z") returned 3 [0054.273] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.273] lstrlenW (lpString=".dbf") returned 4 [0054.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.273] lstrlenW (lpString=".1cd") returned 4 [0054.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.273] lstrlenW (lpString=".jpg") returned 4 [0054.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.273] lstrlenW (lpString=".doc") returned 4 [0054.273] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.273] lstrlenW (lpString=".docx") returned 5 [0054.273] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0054.273] lstrlenW (lpString=".pdf") returned 4 [0054.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.274] lstrlenW (lpString=".xls") returned 4 [0054.274] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.274] lstrlenW (lpString=".xlsx") returned 5 [0054.274] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0054.274] lstrlenW (lpString=".ppt") returned 4 [0054.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.274] lstrlenW (lpString=".zip") returned 4 [0054.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.274] lstrlenW (lpString=".rar") returned 4 [0054.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.274] lstrlenW (lpString=".bz2") returned 4 [0054.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.274] lstrlenW (lpString=".7z") returned 3 [0054.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.274] lstrlenW (lpString=".dbf") returned 4 [0054.274] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.274] lstrlenW (lpString=".1cd") returned 4 [0054.274] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0054.274] lstrlenW (lpString=".jpg") returned 4 [0054.274] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.275] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0054.275] lstrlenW (lpString="Setup.xml") returned 9 [0054.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.123] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1988) returned 1 [0055.123] CloseHandle (hObject=0x1cc) returned 1 [0055.124] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0055.124] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.124] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.124] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.124] GetLastError () returned 0x0 [0055.125] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0055.238] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0055.239] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.239] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.239] SetEndOfFile (hFile=0x1d0) returned 1 [0055.239] CloseHandle (hObject=0x1d0) returned 1 [0055.244] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.244] SetEndOfFile (hFile=0x1cc) returned 1 [0055.245] CloseHandle (hObject=0x1cc) returned 1 [0055.245] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.245] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0055.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.246] lstrlenW (lpString=".doc") returned 4 [0055.246] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.246] lstrlenW (lpString=".docx") returned 5 [0055.246] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0055.246] lstrlenW (lpString=".pdf") returned 4 [0055.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.246] lstrlenW (lpString=".xls") returned 4 [0055.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.246] lstrlenW (lpString=".xlsx") returned 5 [0055.246] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0055.246] lstrlenW (lpString=".ppt") returned 4 [0055.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.246] lstrlenW (lpString=".zip") returned 4 [0055.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.246] lstrlenW (lpString=".rar") returned 4 [0055.246] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.246] lstrlenW (lpString=".bz2") returned 4 [0055.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.246] lstrlenW (lpString=".7z") returned 3 [0055.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.246] lstrlenW (lpString=".dbf") returned 4 [0055.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.246] lstrlenW (lpString=".1cd") returned 4 [0055.246] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.247] lstrlenW (lpString=".jpg") returned 4 [0055.247] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.247] lstrlenW (lpString=".doc") returned 4 [0055.247] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.247] lstrlenW (lpString=".docx") returned 5 [0055.247] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0055.247] lstrlenW (lpString=".pdf") returned 4 [0055.247] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.247] lstrlenW (lpString=".xls") returned 4 [0055.247] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.247] lstrlenW (lpString=".xlsx") returned 5 [0055.247] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0055.247] lstrlenW (lpString=".ppt") returned 4 [0055.247] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.247] lstrlenW (lpString=".zip") returned 4 [0055.247] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.247] lstrlenW (lpString=".rar") returned 4 [0055.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.247] lstrlenW (lpString=".bz2") returned 4 [0055.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.247] lstrlenW (lpString=".7z") returned 3 [0055.248] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.248] lstrlenW (lpString=".dbf") returned 4 [0055.248] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.248] lstrlenW (lpString=".1cd") returned 4 [0055.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0055.248] lstrlenW (lpString=".jpg") returned 4 [0055.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.248] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0055.248] lstrlenW (lpString="Setup.xml") returned 9 [0055.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.248] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2624) returned 1 [0055.249] CloseHandle (hObject=0x1cc) returned 1 [0055.249] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0055.249] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.249] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.249] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.249] GetLastError () returned 0x0 [0055.249] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0xa40, lpOverlapped=0x0) returned 1 [0057.100] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0057.100] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.100] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.101] SetEndOfFile (hFile=0x1d0) returned 1 [0057.101] CloseHandle (hObject=0x1d0) returned 1 [0057.101] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.101] SetEndOfFile (hFile=0x1cc) returned 1 [0057.102] CloseHandle (hObject=0x1cc) returned 1 [0057.102] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0057.102] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0057.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.103] lstrlenW (lpString=".doc") returned 4 [0057.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0057.103] lstrlenW (lpString=".docx") returned 5 [0057.103] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0057.103] lstrlenW (lpString=".pdf") returned 4 [0057.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0057.103] lstrlenW (lpString=".xls") returned 4 [0057.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0057.103] lstrlenW (lpString=".xlsx") returned 5 [0057.103] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0057.103] lstrlenW (lpString=".ppt") returned 4 [0057.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0057.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.103] lstrlenW (lpString=".zip") returned 4 [0057.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0057.103] lstrlenW (lpString=".rar") returned 4 [0057.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0057.103] lstrlenW (lpString=".bz2") returned 4 [0057.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0057.103] lstrlenW (lpString=".7z") returned 3 [0057.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0057.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.103] lstrlenW (lpString=".dbf") returned 4 [0057.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0057.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.103] lstrlenW (lpString=".1cd") returned 4 [0057.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0057.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.103] lstrlenW (lpString=".jpg") returned 4 [0057.103] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.104] lstrlenW (lpString=".doc") returned 4 [0057.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString=".docx") returned 5 [0057.104] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0057.104] lstrlenW (lpString=".pdf") returned 4 [0057.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString=".xls") returned 4 [0057.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString=".xlsx") returned 5 [0057.104] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0057.104] lstrlenW (lpString=".ppt") returned 4 [0057.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.104] lstrlenW (lpString=".zip") returned 4 [0057.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0057.104] lstrlenW (lpString=".rar") returned 4 [0057.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString=".bz2") returned 4 [0057.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString=".7z") returned 3 [0057.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0057.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.104] lstrlenW (lpString=".dbf") returned 4 [0057.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.104] lstrlenW (lpString=".1cd") returned 4 [0057.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0057.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0057.104] lstrlenW (lpString=".jpg") returned 4 [0057.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0057.105] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0057.105] lstrlenW (lpString="boxed-correct.avi") returned 17 [0057.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0058.307] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=89600) returned 1 [0058.307] CloseHandle (hObject=0x208) returned 1 [0058.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0058.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0058.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.308] lstrlenW (lpString=".doc") returned 4 [0058.308] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0058.308] lstrlenW (lpString=".docx") returned 5 [0058.308] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0058.308] lstrlenW (lpString=".pdf") returned 4 [0058.308] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0058.308] lstrlenW (lpString=".xls") returned 4 [0058.308] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0058.308] lstrlenW (lpString=".xlsx") returned 5 [0058.308] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0058.308] lstrlenW (lpString=".ppt") returned 4 [0058.308] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0058.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.308] lstrlenW (lpString=".zip") returned 4 [0058.308] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0058.309] lstrlenW (lpString=".rar") returned 4 [0058.309] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0058.309] lstrlenW (lpString=".bz2") returned 4 [0058.309] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0058.309] lstrlenW (lpString=".7z") returned 3 [0058.309] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0058.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.309] lstrlenW (lpString=".dbf") returned 4 [0058.309] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0058.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.309] lstrlenW (lpString=".1cd") returned 4 [0058.309] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0058.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.309] lstrlenW (lpString=".jpg") returned 4 [0058.309] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0058.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.309] lstrlenW (lpString=".doc") returned 4 [0058.309] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0058.309] lstrlenW (lpString=".docx") returned 5 [0058.309] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0058.309] lstrlenW (lpString=".pdf") returned 4 [0058.309] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0058.309] lstrlenW (lpString=".xls") returned 4 [0058.309] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0058.310] lstrlenW (lpString=".xlsx") returned 5 [0058.310] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0058.310] lstrlenW (lpString=".ppt") returned 4 [0058.310] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0058.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.310] lstrlenW (lpString=".zip") returned 4 [0058.310] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0058.310] lstrlenW (lpString=".rar") returned 4 [0058.310] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0058.310] lstrlenW (lpString=".bz2") returned 4 [0058.310] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0058.311] lstrlenW (lpString=".7z") returned 3 [0058.311] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.311] lstrlenW (lpString=".dbf") returned 4 [0058.311] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.311] lstrlenW (lpString=".1cd") returned 4 [0058.311] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0058.311] lstrlenW (lpString=".jpg") returned 4 [0058.311] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0058.311] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0058.311] lstrlenW (lpString="correct.avi") returned 11 [0058.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0058.311] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=197120) returned 1 [0058.311] CloseHandle (hObject=0x208) returned 1 [0058.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0058.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0058.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.312] lstrlenW (lpString=".doc") returned 4 [0058.312] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0058.312] lstrlenW (lpString=".docx") returned 5 [0058.312] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0058.312] lstrlenW (lpString=".pdf") returned 4 [0058.312] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0058.312] lstrlenW (lpString=".xls") returned 4 [0058.312] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0058.312] lstrlenW (lpString=".xlsx") returned 5 [0058.312] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0058.312] lstrlenW (lpString=".ppt") returned 4 [0058.312] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.312] lstrlenW (lpString=".zip") returned 4 [0058.312] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0058.312] lstrlenW (lpString=".rar") returned 4 [0058.312] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0058.312] lstrlenW (lpString=".bz2") returned 4 [0058.312] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0058.312] lstrlenW (lpString=".7z") returned 3 [0058.313] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0058.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.313] lstrlenW (lpString=".dbf") returned 4 [0058.313] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0058.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.313] lstrlenW (lpString=".1cd") returned 4 [0058.313] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0058.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.313] lstrlenW (lpString=".jpg") returned 4 [0058.313] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0058.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.313] lstrlenW (lpString=".doc") returned 4 [0058.313] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0058.313] lstrlenW (lpString=".docx") returned 5 [0058.313] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0058.313] lstrlenW (lpString=".pdf") returned 4 [0058.313] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0058.313] lstrlenW (lpString=".xls") returned 4 [0058.313] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0058.313] lstrlenW (lpString=".xlsx") returned 5 [0058.313] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0058.313] lstrlenW (lpString=".ppt") returned 4 [0058.313] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0058.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.313] lstrlenW (lpString=".zip") returned 4 [0058.313] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0058.313] lstrlenW (lpString=".rar") returned 4 [0058.313] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0058.313] lstrlenW (lpString=".bz2") returned 4 [0058.314] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0058.314] lstrlenW (lpString=".7z") returned 3 [0058.314] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0058.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.314] lstrlenW (lpString=".dbf") returned 4 [0058.314] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0058.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.314] lstrlenW (lpString=".1cd") returned 4 [0058.314] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0058.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0058.314] lstrlenW (lpString=".jpg") returned 4 [0058.314] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0058.314] lstrcmpiW (lpString1=".avi", lpString2=".beets") returned -1 [0058.314] lstrlenW (lpString="delete.avi") returned 10 [0058.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.325] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=224256) returned 1 [0059.325] CloseHandle (hObject=0x1a4) returned 1 [0059.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0059.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.326] lstrlenW (lpString=".doc") returned 4 [0059.326] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.326] lstrlenW (lpString=".docx") returned 5 [0059.326] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0059.326] lstrlenW (lpString=".pdf") returned 4 [0059.326] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.326] lstrlenW (lpString=".xls") returned 4 [0059.326] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.326] lstrlenW (lpString=".xlsx") returned 5 [0059.326] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0059.326] lstrlenW (lpString=".ppt") returned 4 [0059.326] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.326] lstrlenW (lpString=".zip") returned 4 [0059.326] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.326] lstrlenW (lpString=".rar") returned 4 [0059.326] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.326] lstrlenW (lpString=".bz2") returned 4 [0059.326] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.326] lstrlenW (lpString=".7z") returned 3 [0059.326] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.326] lstrlenW (lpString=".dbf") returned 4 [0059.326] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.326] lstrlenW (lpString=".1cd") returned 4 [0059.326] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.327] lstrlenW (lpString=".jpg") returned 4 [0059.327] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.327] lstrlenW (lpString=".doc") returned 4 [0059.327] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString=".docx") returned 5 [0059.327] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0059.327] lstrlenW (lpString=".pdf") returned 4 [0059.327] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString=".xls") returned 4 [0059.327] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString=".xlsx") returned 5 [0059.327] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0059.327] lstrlenW (lpString=".ppt") returned 4 [0059.327] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.327] lstrlenW (lpString=".zip") returned 4 [0059.327] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString=".rar") returned 4 [0059.327] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString=".bz2") returned 4 [0059.327] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString=".7z") returned 3 [0059.327] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.327] lstrlenW (lpString=".dbf") returned 4 [0059.327] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.327] lstrlenW (lpString=".1cd") returned 4 [0059.327] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0059.328] lstrlenW (lpString=".jpg") returned 4 [0059.328] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0059.328] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.328] lstrlenW (lpString="auxpad.xml") returned 10 [0059.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.616] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=212) returned 1 [0059.616] CloseHandle (hObject=0x1a4) returned 1 [0059.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0059.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0059.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.617] lstrlenW (lpString=".doc") returned 4 [0059.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.617] lstrlenW (lpString=".docx") returned 5 [0059.617] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0059.617] lstrlenW (lpString=".pdf") returned 4 [0059.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.617] lstrlenW (lpString=".xls") returned 4 [0059.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.617] lstrlenW (lpString=".xlsx") returned 5 [0059.617] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0059.617] lstrlenW (lpString=".ppt") returned 4 [0059.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.617] lstrlenW (lpString=".zip") returned 4 [0059.617] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.617] lstrlenW (lpString=".rar") returned 4 [0059.617] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.617] lstrlenW (lpString=".bz2") returned 4 [0059.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.618] lstrlenW (lpString=".7z") returned 3 [0059.618] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.618] lstrlenW (lpString=".dbf") returned 4 [0059.618] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.618] lstrlenW (lpString=".1cd") returned 4 [0059.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.618] lstrlenW (lpString=".jpg") returned 4 [0059.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.618] lstrlenW (lpString=".doc") returned 4 [0059.618] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0059.618] lstrlenW (lpString=".docx") returned 5 [0059.618] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0059.618] lstrlenW (lpString=".pdf") returned 4 [0059.618] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0059.618] lstrlenW (lpString=".xls") returned 4 [0059.619] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0059.619] lstrlenW (lpString=".xlsx") returned 5 [0059.619] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0059.619] lstrlenW (lpString=".ppt") returned 4 [0059.619] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0059.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.619] lstrlenW (lpString=".zip") returned 4 [0059.619] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0059.619] lstrlenW (lpString=".rar") returned 4 [0059.619] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0059.619] lstrlenW (lpString=".bz2") returned 4 [0059.619] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0059.619] lstrlenW (lpString=".7z") returned 3 [0059.619] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0059.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.619] lstrlenW (lpString=".dbf") returned 4 [0059.619] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0059.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.619] lstrlenW (lpString=".1cd") returned 4 [0059.619] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0059.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0059.619] lstrlenW (lpString=".jpg") returned 4 [0059.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0059.620] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0059.620] lstrlenW (lpString="base_rtl.xml") returned 12 [0059.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0060.173] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=617) returned 1 [0060.174] CloseHandle (hObject=0x18c) returned 1 [0060.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0060.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.174] lstrlenW (lpString=".doc") returned 4 [0060.174] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.174] lstrlenW (lpString=".docx") returned 5 [0060.174] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0060.174] lstrlenW (lpString=".pdf") returned 4 [0060.174] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.174] lstrlenW (lpString=".xls") returned 4 [0060.174] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.174] lstrlenW (lpString=".xlsx") returned 5 [0060.174] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0060.174] lstrlenW (lpString=".ppt") returned 4 [0060.174] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.174] lstrlenW (lpString=".zip") returned 4 [0060.175] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.175] lstrlenW (lpString=".rar") returned 4 [0060.175] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.175] lstrlenW (lpString=".bz2") returned 4 [0060.175] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.175] lstrlenW (lpString=".7z") returned 3 [0060.175] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.175] lstrlenW (lpString=".dbf") returned 4 [0060.175] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.175] lstrlenW (lpString=".1cd") returned 4 [0060.175] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.175] lstrlenW (lpString=".jpg") returned 4 [0060.175] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.175] lstrlenW (lpString=".doc") returned 4 [0060.175] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.175] lstrlenW (lpString=".docx") returned 5 [0060.175] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0060.175] lstrlenW (lpString=".pdf") returned 4 [0060.175] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.175] lstrlenW (lpString=".xls") returned 4 [0060.176] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.176] lstrlenW (lpString=".xlsx") returned 5 [0060.176] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0060.176] lstrlenW (lpString=".ppt") returned 4 [0060.176] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.176] lstrlenW (lpString=".zip") returned 4 [0060.176] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.176] lstrlenW (lpString=".rar") returned 4 [0060.176] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.176] lstrlenW (lpString=".bz2") returned 4 [0060.176] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.176] lstrlenW (lpString=".7z") returned 3 [0060.176] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.176] lstrlenW (lpString=".dbf") returned 4 [0060.176] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.176] lstrlenW (lpString=".1cd") returned 4 [0060.176] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0060.176] lstrlenW (lpString=".jpg") returned 4 [0060.177] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.177] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.177] lstrlenW (lpString="zh-changjei.xml") returned 15 [0060.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.543] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=9803) returned 1 [0060.544] CloseHandle (hObject=0x184) returned 1 [0060.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0060.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.544] lstrlenW (lpString=".doc") returned 4 [0060.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.544] lstrlenW (lpString=".docx") returned 5 [0060.544] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0060.544] lstrlenW (lpString=".pdf") returned 4 [0060.544] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.544] lstrlenW (lpString=".xls") returned 4 [0060.544] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.544] lstrlenW (lpString=".xlsx") returned 5 [0060.544] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0060.544] lstrlenW (lpString=".ppt") returned 4 [0060.544] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.544] lstrlenW (lpString=".zip") returned 4 [0060.544] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.544] lstrlenW (lpString=".rar") returned 4 [0060.544] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.544] lstrlenW (lpString=".bz2") returned 4 [0060.544] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.544] lstrlenW (lpString=".7z") returned 3 [0060.544] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.545] lstrlenW (lpString=".dbf") returned 4 [0060.545] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.545] lstrlenW (lpString=".1cd") returned 4 [0060.545] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.545] lstrlenW (lpString=".jpg") returned 4 [0060.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.545] lstrlenW (lpString=".doc") returned 4 [0060.545] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.545] lstrlenW (lpString=".docx") returned 5 [0060.545] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0060.545] lstrlenW (lpString=".pdf") returned 4 [0060.545] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.545] lstrlenW (lpString=".xls") returned 4 [0060.545] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.545] lstrlenW (lpString=".xlsx") returned 5 [0060.545] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0060.545] lstrlenW (lpString=".ppt") returned 4 [0060.545] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.545] lstrlenW (lpString=".zip") returned 4 [0060.545] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.545] lstrlenW (lpString=".rar") returned 4 [0060.545] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.545] lstrlenW (lpString=".bz2") returned 4 [0060.545] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.546] lstrlenW (lpString=".7z") returned 3 [0060.546] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.546] lstrlenW (lpString=".dbf") returned 4 [0060.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.546] lstrlenW (lpString=".1cd") returned 4 [0060.546] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0060.546] lstrlenW (lpString=".jpg") returned 4 [0060.546] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.546] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.546] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0060.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.547] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1437) returned 1 [0060.548] CloseHandle (hObject=0x184) returned 1 [0060.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0060.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.548] lstrlenW (lpString=".doc") returned 4 [0060.548] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString=".docx") returned 5 [0060.548] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0060.548] lstrlenW (lpString=".pdf") returned 4 [0060.548] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString=".xls") returned 4 [0060.548] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString=".xlsx") returned 5 [0060.548] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0060.548] lstrlenW (lpString=".ppt") returned 4 [0060.548] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.549] lstrlenW (lpString=".zip") returned 4 [0060.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.549] lstrlenW (lpString=".rar") returned 4 [0060.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.549] lstrlenW (lpString=".bz2") returned 4 [0060.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.549] lstrlenW (lpString=".7z") returned 3 [0060.549] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.549] lstrlenW (lpString=".dbf") returned 4 [0060.549] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.549] lstrlenW (lpString=".1cd") returned 4 [0060.549] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.549] lstrlenW (lpString=".jpg") returned 4 [0060.549] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.549] lstrlenW (lpString=".doc") returned 4 [0060.549] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.549] lstrlenW (lpString=".docx") returned 5 [0060.549] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0060.549] lstrlenW (lpString=".pdf") returned 4 [0060.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.549] lstrlenW (lpString=".xls") returned 4 [0060.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.550] lstrlenW (lpString=".xlsx") returned 5 [0060.550] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0060.550] lstrlenW (lpString=".ppt") returned 4 [0060.550] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.550] lstrlenW (lpString=".zip") returned 4 [0060.550] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.550] lstrlenW (lpString=".rar") returned 4 [0060.550] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.550] lstrlenW (lpString=".bz2") returned 4 [0060.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.550] lstrlenW (lpString=".7z") returned 3 [0060.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.550] lstrlenW (lpString=".dbf") returned 4 [0060.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.550] lstrlenW (lpString=".1cd") returned 4 [0060.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0060.550] lstrlenW (lpString=".jpg") returned 4 [0060.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.550] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.550] lstrlenW (lpString="oskpredbase.xml") returned 15 [0060.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.551] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=924) returned 1 [0060.551] CloseHandle (hObject=0x184) returned 1 [0060.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0060.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0060.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.552] lstrlenW (lpString=".doc") returned 4 [0060.552] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.552] lstrlenW (lpString=".docx") returned 5 [0060.552] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0060.552] lstrlenW (lpString=".pdf") returned 4 [0060.552] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.552] lstrlenW (lpString=".xls") returned 4 [0060.552] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.552] lstrlenW (lpString=".xlsx") returned 5 [0060.552] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0060.552] lstrlenW (lpString=".ppt") returned 4 [0060.552] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.552] lstrlenW (lpString=".zip") returned 4 [0060.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.552] lstrlenW (lpString=".rar") returned 4 [0060.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.552] lstrlenW (lpString=".bz2") returned 4 [0060.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.552] lstrlenW (lpString=".7z") returned 3 [0060.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.552] lstrlenW (lpString=".dbf") returned 4 [0060.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.553] lstrlenW (lpString=".1cd") returned 4 [0060.553] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.553] lstrlenW (lpString=".jpg") returned 4 [0060.553] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.553] lstrlenW (lpString=".doc") returned 4 [0060.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString=".docx") returned 5 [0060.553] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0060.553] lstrlenW (lpString=".pdf") returned 4 [0060.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString=".xls") returned 4 [0060.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString=".xlsx") returned 5 [0060.553] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0060.553] lstrlenW (lpString=".ppt") returned 4 [0060.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.553] lstrlenW (lpString=".zip") returned 4 [0060.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.553] lstrlenW (lpString=".rar") returned 4 [0060.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString=".bz2") returned 4 [0060.553] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.553] lstrlenW (lpString=".7z") returned 3 [0060.553] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.553] lstrlenW (lpString=".dbf") returned 4 [0060.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.554] lstrlenW (lpString=".1cd") returned 4 [0060.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0060.554] lstrlenW (lpString=".jpg") returned 4 [0060.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.554] lstrcmpiW (lpString1=".xml", lpString2=".beets") returned 1 [0060.554] lstrlenW (lpString="oskpred.xml") returned 11 [0060.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.112] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=215) returned 1 [0061.112] CloseHandle (hObject=0x1a4) returned 1 [0061.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0061.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.113] lstrlenW (lpString=".doc") returned 4 [0061.113] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.113] lstrlenW (lpString=".docx") returned 5 [0061.113] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0061.113] lstrlenW (lpString=".pdf") returned 4 [0061.113] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.113] lstrlenW (lpString=".xls") returned 4 [0061.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.113] lstrlenW (lpString=".xlsx") returned 5 [0061.113] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0061.113] lstrlenW (lpString=".ppt") returned 4 [0061.113] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.113] lstrlenW (lpString=".zip") returned 4 [0061.113] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.113] lstrlenW (lpString=".rar") returned 4 [0061.113] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.113] lstrlenW (lpString=".bz2") returned 4 [0061.113] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.113] lstrlenW (lpString=".7z") returned 3 [0061.113] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.113] lstrlenW (lpString=".dbf") returned 4 [0061.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.113] lstrlenW (lpString=".1cd") returned 4 [0061.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.113] lstrlenW (lpString=".jpg") returned 4 [0061.113] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.114] lstrlenW (lpString=".doc") returned 4 [0061.114] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString=".docx") returned 5 [0061.114] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0061.114] lstrlenW (lpString=".pdf") returned 4 [0061.114] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString=".xls") returned 4 [0061.114] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString=".xlsx") returned 5 [0061.114] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0061.114] lstrlenW (lpString=".ppt") returned 4 [0061.114] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.114] lstrlenW (lpString=".zip") returned 4 [0061.114] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.114] lstrlenW (lpString=".rar") returned 4 [0061.114] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString=".bz2") returned 4 [0061.114] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString=".7z") returned 3 [0061.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.114] lstrlenW (lpString=".dbf") returned 4 [0061.114] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.114] lstrlenW (lpString=".1cd") returned 4 [0061.114] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0061.114] lstrlenW (lpString=".jpg") returned 4 [0061.115] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.115] lstrcmpiW (lpString1=".dat", lpString2=".beets") returned 1 [0061.115] lstrlenW (lpString="hwrenclm.dat") returned 12 [0061.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0061.294] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=815680) returned 1 [0061.295] CloseHandle (hObject=0x1cc) returned 1 [0061.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0061.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.295] lstrlenW (lpString=".doc") returned 4 [0061.295] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0061.295] lstrlenW (lpString=".docx") returned 5 [0061.295] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0061.295] lstrlenW (lpString=".pdf") returned 4 [0061.295] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0061.295] lstrlenW (lpString=".xls") returned 4 [0061.295] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0061.295] lstrlenW (lpString=".xlsx") returned 5 [0061.295] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0061.295] lstrlenW (lpString=".ppt") returned 4 [0061.295] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0061.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.295] lstrlenW (lpString=".zip") returned 4 [0061.295] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0061.295] lstrlenW (lpString=".rar") returned 4 [0061.295] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0061.295] lstrlenW (lpString=".bz2") returned 4 [0061.296] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0061.296] lstrlenW (lpString=".7z") returned 3 [0061.296] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.296] lstrlenW (lpString=".dbf") returned 4 [0061.296] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.296] lstrlenW (lpString=".1cd") returned 4 [0061.296] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.296] lstrlenW (lpString=".jpg") returned 4 [0061.296] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.296] lstrlenW (lpString=".doc") returned 4 [0061.296] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0061.296] lstrlenW (lpString=".docx") returned 5 [0061.296] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0061.296] lstrlenW (lpString=".pdf") returned 4 [0061.296] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0061.296] lstrlenW (lpString=".xls") returned 4 [0061.296] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0061.296] lstrlenW (lpString=".xlsx") returned 5 [0061.297] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0061.297] lstrlenW (lpString=".ppt") returned 4 [0061.297] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0061.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.297] lstrlenW (lpString=".zip") returned 4 [0061.297] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0061.297] lstrlenW (lpString=".rar") returned 4 [0061.297] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0061.297] lstrlenW (lpString=".bz2") returned 4 [0061.297] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0061.297] lstrlenW (lpString=".7z") returned 3 [0061.297] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0061.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.297] lstrlenW (lpString=".dbf") returned 4 [0061.297] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0061.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.297] lstrlenW (lpString=".1cd") returned 4 [0061.297] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0061.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0061.297] lstrlenW (lpString=".jpg") returned 4 [0061.297] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0061.297] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0061.298] lstrlenW (lpString="AccessMUI.XML") returned 13 [0061.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.682] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1349) returned 1 [0061.682] CloseHandle (hObject=0x1c8) returned 1 [0061.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0061.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.683] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.683] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.683] GetLastError () returned 0x0 [0061.683] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x545, lpOverlapped=0x0) returned 1 [0061.760] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x550, lpOverlapped=0x0) returned 1 [0061.761] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.762] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xee, lpOverlapped=0x0) returned 1 [0061.762] SetEndOfFile (hFile=0x1c4) returned 1 [0061.762] CloseHandle (hObject=0x1c4) returned 1 [0061.764] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.764] SetEndOfFile (hFile=0x1c8) returned 1 [0061.765] CloseHandle (hObject=0x1c8) returned 1 [0061.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0061.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0061.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.766] lstrlenW (lpString=".doc") returned 4 [0061.766] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.766] lstrlenW (lpString=".docx") returned 5 [0061.766] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0061.766] lstrlenW (lpString=".pdf") returned 4 [0061.766] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.766] lstrlenW (lpString=".xls") returned 4 [0061.766] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.766] lstrlenW (lpString=".xlsx") returned 5 [0061.766] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0061.766] lstrlenW (lpString=".ppt") returned 4 [0061.766] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.766] lstrlenW (lpString=".zip") returned 4 [0061.766] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.766] lstrlenW (lpString=".rar") returned 4 [0061.766] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.766] lstrlenW (lpString=".bz2") returned 4 [0061.767] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.767] lstrlenW (lpString=".7z") returned 3 [0061.767] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.767] lstrlenW (lpString=".dbf") returned 4 [0061.767] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.767] lstrlenW (lpString=".1cd") returned 4 [0061.767] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.767] lstrlenW (lpString=".jpg") returned 4 [0061.767] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.767] lstrlenW (lpString=".doc") returned 4 [0061.767] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.767] lstrlenW (lpString=".docx") returned 5 [0061.767] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0061.767] lstrlenW (lpString=".pdf") returned 4 [0061.767] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.767] lstrlenW (lpString=".xls") returned 4 [0061.767] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.767] lstrlenW (lpString=".xlsx") returned 5 [0061.767] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0061.767] lstrlenW (lpString=".ppt") returned 4 [0061.768] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.768] lstrlenW (lpString=".zip") returned 4 [0061.768] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.768] lstrlenW (lpString=".rar") returned 4 [0061.768] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.768] lstrlenW (lpString=".bz2") returned 4 [0061.768] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.768] lstrlenW (lpString=".7z") returned 3 [0061.768] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.768] lstrlenW (lpString=".dbf") returned 4 [0061.768] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.768] lstrlenW (lpString=".1cd") returned 4 [0061.768] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0061.768] lstrlenW (lpString=".jpg") returned 4 [0061.768] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.768] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0061.768] lstrlenW (lpString="SETUP.XML") returned 9 [0061.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.772] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2624) returned 1 [0061.773] CloseHandle (hObject=0x1c8) returned 1 [0061.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0061.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.774] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.774] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.774] GetLastError () returned 0x0 [0061.774] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0xa40, lpOverlapped=0x0) returned 1 [0061.805] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0061.805] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.805] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.806] SetEndOfFile (hFile=0x1c4) returned 1 [0061.806] CloseHandle (hObject=0x1c4) returned 1 [0061.808] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.808] SetEndOfFile (hFile=0x1c8) returned 1 [0061.808] CloseHandle (hObject=0x1c8) returned 1 [0061.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0061.809] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0061.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.810] lstrlenW (lpString=".doc") returned 4 [0061.810] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.810] lstrlenW (lpString=".docx") returned 5 [0061.810] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0061.810] lstrlenW (lpString=".pdf") returned 4 [0061.810] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.811] lstrlenW (lpString=".xls") returned 4 [0061.811] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.811] lstrlenW (lpString=".xlsx") returned 5 [0061.811] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0061.811] lstrlenW (lpString=".ppt") returned 4 [0061.811] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.811] lstrlenW (lpString=".zip") returned 4 [0061.811] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.811] lstrlenW (lpString=".rar") returned 4 [0061.811] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.811] lstrlenW (lpString=".bz2") returned 4 [0061.811] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.811] lstrlenW (lpString=".7z") returned 3 [0061.811] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.811] lstrlenW (lpString=".dbf") returned 4 [0061.811] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.811] lstrlenW (lpString=".1cd") returned 4 [0061.811] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.812] lstrlenW (lpString=".jpg") returned 4 [0061.812] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.812] lstrlenW (lpString=".doc") returned 4 [0061.812] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.812] lstrlenW (lpString=".docx") returned 5 [0061.812] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0061.812] lstrlenW (lpString=".pdf") returned 4 [0061.812] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.812] lstrlenW (lpString=".xls") returned 4 [0061.812] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.812] lstrlenW (lpString=".xlsx") returned 5 [0061.812] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0061.812] lstrlenW (lpString=".ppt") returned 4 [0061.812] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.812] lstrlenW (lpString=".zip") returned 4 [0061.812] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.812] lstrlenW (lpString=".rar") returned 4 [0061.813] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.813] lstrlenW (lpString=".bz2") returned 4 [0061.813] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.813] lstrlenW (lpString=".7z") returned 3 [0061.813] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.813] lstrlenW (lpString=".dbf") returned 4 [0061.813] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.813] lstrlenW (lpString=".1cd") returned 4 [0061.813] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0061.813] lstrlenW (lpString=".jpg") returned 4 [0061.813] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.813] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0061.813] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0061.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.814] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1565) returned 1 [0061.814] CloseHandle (hObject=0x1c8) returned 1 [0061.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0061.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.815] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.815] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.815] GetLastError () returned 0x0 [0061.816] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x61d, lpOverlapped=0x0) returned 1 [0066.405] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x620, lpOverlapped=0x0) returned 1 [0066.406] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.406] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.406] SetEndOfFile (hFile=0x1c4) returned 1 [0067.427] CloseHandle (hObject=0x1c4) returned 1 [0067.427] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.427] SetEndOfFile (hFile=0x1c8) returned 1 [0067.445] CloseHandle (hObject=0x1c8) returned 1 [0067.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0067.446] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0067.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.446] lstrlenW (lpString=".doc") returned 4 [0067.446] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.446] lstrlenW (lpString=".docx") returned 5 [0067.446] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0067.446] lstrlenW (lpString=".pdf") returned 4 [0067.446] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.446] lstrlenW (lpString=".xls") returned 4 [0067.446] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.446] lstrlenW (lpString=".xlsx") returned 5 [0067.446] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0067.446] lstrlenW (lpString=".ppt") returned 4 [0067.446] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.446] lstrlenW (lpString=".zip") returned 4 [0067.446] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.446] lstrlenW (lpString=".rar") returned 4 [0067.446] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.446] lstrlenW (lpString=".bz2") returned 4 [0067.446] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.446] lstrlenW (lpString=".7z") returned 3 [0067.446] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.446] lstrlenW (lpString=".dbf") returned 4 [0067.446] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.446] lstrlenW (lpString=".1cd") returned 4 [0067.446] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.446] lstrlenW (lpString=".jpg") returned 4 [0067.447] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.447] lstrlenW (lpString=".doc") returned 4 [0067.447] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString=".docx") returned 5 [0067.447] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0067.447] lstrlenW (lpString=".pdf") returned 4 [0067.447] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString=".xls") returned 4 [0067.447] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString=".xlsx") returned 5 [0067.447] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0067.447] lstrlenW (lpString=".ppt") returned 4 [0067.447] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.447] lstrlenW (lpString=".zip") returned 4 [0067.447] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0067.447] lstrlenW (lpString=".rar") returned 4 [0067.447] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString=".bz2") returned 4 [0067.447] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString=".7z") returned 3 [0067.447] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0067.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.447] lstrlenW (lpString=".dbf") returned 4 [0067.447] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.447] lstrlenW (lpString=".1cd") returned 4 [0067.447] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0067.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0067.447] lstrlenW (lpString=".jpg") returned 4 [0067.447] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0067.448] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0067.448] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0067.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0067.448] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1231) returned 1 [0067.448] CloseHandle (hObject=0x1c8) returned 1 [0067.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0067.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0067.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0067.448] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.448] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0067.665] GetLastError () returned 0x0 [0067.665] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0068.054] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0068.054] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.054] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0068.054] SetEndOfFile (hFile=0x1a4) returned 1 [0068.055] CloseHandle (hObject=0x1a4) returned 1 [0068.055] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.055] SetEndOfFile (hFile=0x1c8) returned 1 [0068.056] CloseHandle (hObject=0x1c8) returned 1 [0068.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0068.056] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0068.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.056] lstrlenW (lpString=".doc") returned 4 [0068.056] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.056] lstrlenW (lpString=".docx") returned 5 [0068.056] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0068.057] lstrlenW (lpString=".pdf") returned 4 [0068.057] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString=".xls") returned 4 [0068.057] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString=".xlsx") returned 5 [0068.057] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0068.057] lstrlenW (lpString=".ppt") returned 4 [0068.057] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.057] lstrlenW (lpString=".zip") returned 4 [0068.057] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.057] lstrlenW (lpString=".rar") returned 4 [0068.057] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString=".bz2") returned 4 [0068.057] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString=".7z") returned 3 [0068.057] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.057] lstrlenW (lpString=".dbf") returned 4 [0068.057] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.057] lstrlenW (lpString=".1cd") returned 4 [0068.057] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.057] lstrlenW (lpString=".jpg") returned 4 [0068.057] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.057] lstrlenW (lpString=".doc") returned 4 [0068.057] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString=".docx") returned 5 [0068.057] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0068.057] lstrlenW (lpString=".pdf") returned 4 [0068.057] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString=".xls") returned 4 [0068.057] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.057] lstrlenW (lpString=".xlsx") returned 5 [0068.057] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0068.058] lstrlenW (lpString=".ppt") returned 4 [0068.058] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.058] lstrlenW (lpString=".zip") returned 4 [0068.058] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.058] lstrlenW (lpString=".rar") returned 4 [0068.058] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.058] lstrlenW (lpString=".bz2") returned 4 [0068.058] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.058] lstrlenW (lpString=".7z") returned 3 [0068.058] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.058] lstrlenW (lpString=".dbf") returned 4 [0068.058] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.058] lstrlenW (lpString=".1cd") returned 4 [0068.058] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0068.058] lstrlenW (lpString=".jpg") returned 4 [0068.058] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.058] lstrcmpiW (lpString1=".CHM", lpString2=".beets") returned 1 [0068.058] lstrlenW (lpString="PSS10O.CHM") returned 10 [0068.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.296] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=26929) returned 1 [0068.296] CloseHandle (hObject=0x1cc) returned 1 [0068.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0068.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0068.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.296] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.296] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0068.296] GetLastError () returned 0x0 [0068.296] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x6931, lpOverlapped=0x0) returned 1 [0068.933] WriteFile (in: hFile=0x16c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0068.934] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.934] WriteFile (in: hFile=0x16c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0068.934] SetEndOfFile (hFile=0x16c) returned 1 [0069.729] CloseHandle (hObject=0x16c) returned 1 [0069.749] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.749] SetEndOfFile (hFile=0x1cc) returned 1 [0069.750] CloseHandle (hObject=0x1cc) returned 1 [0069.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0069.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0069.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.751] lstrlenW (lpString=".doc") returned 4 [0069.751] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.751] lstrlenW (lpString=".docx") returned 5 [0069.751] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0069.751] lstrlenW (lpString=".pdf") returned 4 [0069.751] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.751] lstrlenW (lpString=".xls") returned 4 [0069.751] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.751] lstrlenW (lpString=".xlsx") returned 5 [0069.751] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0069.751] lstrlenW (lpString=".ppt") returned 4 [0069.751] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.752] lstrlenW (lpString=".zip") returned 4 [0069.752] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.752] lstrlenW (lpString=".rar") returned 4 [0069.752] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.752] lstrlenW (lpString=".bz2") returned 4 [0069.752] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.752] lstrlenW (lpString=".7z") returned 3 [0069.752] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.752] lstrlenW (lpString=".dbf") returned 4 [0069.752] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.752] lstrlenW (lpString=".1cd") returned 4 [0069.752] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.752] lstrlenW (lpString=".jpg") returned 4 [0069.752] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.752] lstrlenW (lpString=".doc") returned 4 [0069.752] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0069.752] lstrlenW (lpString=".docx") returned 5 [0069.752] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0069.752] lstrlenW (lpString=".pdf") returned 4 [0069.752] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0069.752] lstrlenW (lpString=".xls") returned 4 [0069.752] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0069.752] lstrlenW (lpString=".xlsx") returned 5 [0069.752] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0069.753] lstrlenW (lpString=".ppt") returned 4 [0069.753] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.753] lstrlenW (lpString=".zip") returned 4 [0069.753] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0069.753] lstrlenW (lpString=".rar") returned 4 [0069.753] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0069.753] lstrlenW (lpString=".bz2") returned 4 [0069.753] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0069.753] lstrlenW (lpString=".7z") returned 3 [0069.753] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.753] lstrlenW (lpString=".dbf") returned 4 [0069.753] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.753] lstrlenW (lpString=".1cd") returned 4 [0069.753] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0069.753] lstrlenW (lpString=".jpg") returned 4 [0069.753] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0069.753] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.753] lstrlenW (lpString="Office32MUI.XML") returned 15 [0069.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.755] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1383) returned 1 [0069.755] CloseHandle (hObject=0x1cc) returned 1 [0069.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0069.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.756] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.756] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0069.858] GetLastError () returned 0x0 [0069.858] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x567, lpOverlapped=0x0) returned 1 [0069.880] WriteFile (in: hFile=0x19c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x570, lpOverlapped=0x0) returned 1 [0069.881] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.881] WriteFile (in: hFile=0x19c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0069.881] SetEndOfFile (hFile=0x19c) returned 1 [0069.881] CloseHandle (hObject=0x19c) returned 1 [0069.882] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.882] SetEndOfFile (hFile=0x1cc) returned 1 [0069.882] CloseHandle (hObject=0x1cc) returned 1 [0069.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0069.882] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0069.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.883] lstrlenW (lpString=".doc") returned 4 [0069.883] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.883] lstrlenW (lpString=".docx") returned 5 [0069.883] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0069.883] lstrlenW (lpString=".pdf") returned 4 [0069.883] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.883] lstrlenW (lpString=".xls") returned 4 [0069.883] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.883] lstrlenW (lpString=".xlsx") returned 5 [0069.883] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0069.883] lstrlenW (lpString=".ppt") returned 4 [0069.883] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.883] lstrlenW (lpString=".zip") returned 4 [0069.883] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.883] lstrlenW (lpString=".rar") returned 4 [0069.883] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.883] lstrlenW (lpString=".bz2") returned 4 [0069.883] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.883] lstrlenW (lpString=".7z") returned 3 [0069.883] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.889] lstrlenW (lpString=".dbf") returned 4 [0069.889] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.889] lstrlenW (lpString=".1cd") returned 4 [0069.890] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.890] lstrlenW (lpString=".jpg") returned 4 [0069.890] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.890] lstrlenW (lpString=".doc") returned 4 [0069.890] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.890] lstrlenW (lpString=".docx") returned 5 [0069.890] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0069.890] lstrlenW (lpString=".pdf") returned 4 [0069.890] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.890] lstrlenW (lpString=".xls") returned 4 [0069.890] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.890] lstrlenW (lpString=".xlsx") returned 5 [0069.890] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0069.890] lstrlenW (lpString=".ppt") returned 4 [0069.890] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.890] lstrlenW (lpString=".zip") returned 4 [0069.890] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.890] lstrlenW (lpString=".rar") returned 4 [0069.890] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.890] lstrlenW (lpString=".bz2") returned 4 [0069.890] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.890] lstrlenW (lpString=".7z") returned 3 [0069.890] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.890] lstrlenW (lpString=".dbf") returned 4 [0069.891] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.891] lstrlenW (lpString=".1cd") returned 4 [0069.891] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0069.891] lstrlenW (lpString=".jpg") returned 4 [0069.891] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.891] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.891] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0069.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.891] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=3186) returned 1 [0069.891] CloseHandle (hObject=0x20c) returned 1 [0069.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0069.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.892] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.892] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.898] GetLastError () returned 0x0 [0069.898] ReadFile (in: hFile=0x20c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0xc72, lpOverlapped=0x0) returned 1 [0069.971] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0069.972] ReadFile (in: hFile=0x20c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.972] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0069.972] SetEndOfFile (hFile=0x1cc) returned 1 [0069.972] CloseHandle (hObject=0x1cc) returned 1 [0069.972] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.972] SetEndOfFile (hFile=0x20c) returned 1 [0069.973] CloseHandle (hObject=0x20c) returned 1 [0069.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0069.973] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0069.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.973] lstrlenW (lpString=".doc") returned 4 [0069.973] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.973] lstrlenW (lpString=".docx") returned 5 [0069.973] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0069.973] lstrlenW (lpString=".pdf") returned 4 [0069.973] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.973] lstrlenW (lpString=".xls") returned 4 [0069.973] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.973] lstrlenW (lpString=".xlsx") returned 5 [0069.973] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0069.973] lstrlenW (lpString=".ppt") returned 4 [0069.973] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.974] lstrlenW (lpString=".zip") returned 4 [0069.974] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.974] lstrlenW (lpString=".rar") returned 4 [0069.974] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString=".bz2") returned 4 [0069.974] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString=".7z") returned 3 [0069.974] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.974] lstrlenW (lpString=".dbf") returned 4 [0069.974] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.974] lstrlenW (lpString=".1cd") returned 4 [0069.974] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.974] lstrlenW (lpString=".jpg") returned 4 [0069.974] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.974] lstrlenW (lpString=".doc") returned 4 [0069.974] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString=".docx") returned 5 [0069.974] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0069.974] lstrlenW (lpString=".pdf") returned 4 [0069.974] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString=".xls") returned 4 [0069.974] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString=".xlsx") returned 5 [0069.974] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0069.974] lstrlenW (lpString=".ppt") returned 4 [0069.974] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.974] lstrlenW (lpString=".zip") returned 4 [0069.975] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.975] lstrlenW (lpString=".rar") returned 4 [0069.975] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.975] lstrlenW (lpString=".bz2") returned 4 [0069.975] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.975] lstrlenW (lpString=".7z") returned 3 [0069.975] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.975] lstrlenW (lpString=".dbf") returned 4 [0069.975] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.975] lstrlenW (lpString=".1cd") returned 4 [0069.975] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0069.975] lstrlenW (lpString=".jpg") returned 4 [0069.975] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.975] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0069.975] lstrlenW (lpString="SETUP.XML") returned 9 [0069.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0069.986] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=4207) returned 1 [0069.986] CloseHandle (hObject=0x1d0) returned 1 [0069.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0069.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0069.986] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.987] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.987] GetLastError () returned 0x0 [0069.987] ReadFile (in: hFile=0x1d0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x106f, lpOverlapped=0x0) returned 1 [0070.160] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0070.161] ReadFile (in: hFile=0x1d0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.161] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.161] SetEndOfFile (hFile=0x20c) returned 1 [0070.161] CloseHandle (hObject=0x20c) returned 1 [0070.161] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.161] SetEndOfFile (hFile=0x1d0) returned 1 [0070.161] CloseHandle (hObject=0x1d0) returned 1 [0070.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.162] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0070.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.162] lstrlenW (lpString=".doc") returned 4 [0070.162] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.162] lstrlenW (lpString=".docx") returned 5 [0070.162] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.162] lstrlenW (lpString=".pdf") returned 4 [0070.162] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.162] lstrlenW (lpString=".xls") returned 4 [0070.162] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.162] lstrlenW (lpString=".xlsx") returned 5 [0070.162] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.162] lstrlenW (lpString=".ppt") returned 4 [0070.163] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.163] lstrlenW (lpString=".zip") returned 4 [0070.163] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.163] lstrlenW (lpString=".rar") returned 4 [0070.163] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString=".bz2") returned 4 [0070.163] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString=".7z") returned 3 [0070.163] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.163] lstrlenW (lpString=".dbf") returned 4 [0070.163] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.163] lstrlenW (lpString=".1cd") returned 4 [0070.163] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.163] lstrlenW (lpString=".jpg") returned 4 [0070.163] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.163] lstrlenW (lpString=".doc") returned 4 [0070.163] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString=".docx") returned 5 [0070.163] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.163] lstrlenW (lpString=".pdf") returned 4 [0070.163] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString=".xls") returned 4 [0070.163] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.163] lstrlenW (lpString=".xlsx") returned 5 [0070.164] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.164] lstrlenW (lpString=".ppt") returned 4 [0070.164] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.164] lstrlenW (lpString=".zip") returned 4 [0070.164] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.164] lstrlenW (lpString=".rar") returned 4 [0070.164] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.164] lstrlenW (lpString=".bz2") returned 4 [0070.164] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.164] lstrlenW (lpString=".7z") returned 3 [0070.164] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.164] lstrlenW (lpString=".dbf") returned 4 [0070.164] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.164] lstrlenW (lpString=".1cd") returned 4 [0070.164] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0070.164] lstrlenW (lpString=".jpg") returned 4 [0070.164] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.164] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.164] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0070.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.579] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=6421) returned 1 [0070.579] CloseHandle (hObject=0x18c) returned 1 [0070.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0070.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.579] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.579] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0070.900] GetLastError () returned 0x0 [0070.900] ReadFile (in: hFile=0x18c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x1915, lpOverlapped=0x0) returned 1 [0070.987] WriteFile (in: hFile=0x16c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0070.988] ReadFile (in: hFile=0x18c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.988] WriteFile (in: hFile=0x16c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xee, lpOverlapped=0x0) returned 1 [0070.988] SetEndOfFile (hFile=0x16c) returned 1 [0070.988] CloseHandle (hObject=0x16c) returned 1 [0070.988] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.988] SetEndOfFile (hFile=0x18c) returned 1 [0070.989] CloseHandle (hObject=0x18c) returned 1 [0070.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0070.989] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0070.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.989] lstrlenW (lpString=".doc") returned 4 [0070.990] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString=".docx") returned 5 [0070.990] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0070.990] lstrlenW (lpString=".pdf") returned 4 [0070.990] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString=".xls") returned 4 [0070.990] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString=".xlsx") returned 5 [0070.990] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0070.990] lstrlenW (lpString=".ppt") returned 4 [0070.990] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.990] lstrlenW (lpString=".zip") returned 4 [0070.990] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.990] lstrlenW (lpString=".rar") returned 4 [0070.990] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString=".bz2") returned 4 [0070.990] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString=".7z") returned 3 [0070.990] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.990] lstrlenW (lpString=".dbf") returned 4 [0070.990] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.990] lstrlenW (lpString=".1cd") returned 4 [0070.990] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.990] lstrlenW (lpString=".jpg") returned 4 [0070.990] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.990] lstrlenW (lpString=".doc") returned 4 [0070.990] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.990] lstrlenW (lpString=".docx") returned 5 [0070.990] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0070.990] lstrlenW (lpString=".pdf") returned 4 [0070.990] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.991] lstrlenW (lpString=".xls") returned 4 [0070.991] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.991] lstrlenW (lpString=".xlsx") returned 5 [0070.991] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0070.991] lstrlenW (lpString=".ppt") returned 4 [0070.991] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.991] lstrlenW (lpString=".zip") returned 4 [0070.991] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.991] lstrlenW (lpString=".rar") returned 4 [0070.991] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.991] lstrlenW (lpString=".bz2") returned 4 [0070.991] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.991] lstrlenW (lpString=".7z") returned 3 [0070.991] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.991] lstrlenW (lpString=".dbf") returned 4 [0070.991] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.991] lstrlenW (lpString=".1cd") returned 4 [0070.991] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0070.991] lstrlenW (lpString=".jpg") returned 4 [0070.991] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.991] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0070.991] lstrlenW (lpString="SETUP.XML") returned 9 [0070.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.992] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=5884) returned 1 [0070.992] CloseHandle (hObject=0x18c) returned 1 [0070.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0070.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.992] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.992] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.190] GetLastError () returned 0x0 [0071.190] ReadFile (in: hFile=0x18c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0071.297] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0071.298] ReadFile (in: hFile=0x18c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.299] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.299] SetEndOfFile (hFile=0x1a4) returned 1 [0071.299] CloseHandle (hObject=0x1a4) returned 1 [0071.299] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.299] SetEndOfFile (hFile=0x18c) returned 1 [0071.300] CloseHandle (hObject=0x18c) returned 1 [0071.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.300] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0071.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.301] lstrlenW (lpString=".doc") returned 4 [0071.301] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString=".docx") returned 5 [0071.301] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.301] lstrlenW (lpString=".pdf") returned 4 [0071.301] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString=".xls") returned 4 [0071.301] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString=".xlsx") returned 5 [0071.301] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.301] lstrlenW (lpString=".ppt") returned 4 [0071.301] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.301] lstrlenW (lpString=".zip") returned 4 [0071.301] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.301] lstrlenW (lpString=".rar") returned 4 [0071.301] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString=".bz2") returned 4 [0071.301] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString=".7z") returned 3 [0071.301] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.301] lstrlenW (lpString=".dbf") returned 4 [0071.301] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.301] lstrlenW (lpString=".1cd") returned 4 [0071.301] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.301] lstrlenW (lpString=".jpg") returned 4 [0071.301] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.302] lstrlenW (lpString=".doc") returned 4 [0071.302] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.302] lstrlenW (lpString=".docx") returned 5 [0071.302] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.302] lstrlenW (lpString=".pdf") returned 4 [0071.302] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.302] lstrlenW (lpString=".xls") returned 4 [0071.302] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.302] lstrlenW (lpString=".xlsx") returned 5 [0071.302] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.302] lstrlenW (lpString=".ppt") returned 4 [0071.302] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.302] lstrlenW (lpString=".zip") returned 4 [0071.302] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.302] lstrlenW (lpString=".rar") returned 4 [0071.302] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.302] lstrlenW (lpString=".bz2") returned 4 [0071.302] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.302] lstrlenW (lpString=".7z") returned 3 [0071.302] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.302] lstrlenW (lpString=".dbf") returned 4 [0071.302] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.302] lstrlenW (lpString=".1cd") returned 4 [0071.302] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0071.302] lstrlenW (lpString=".jpg") returned 4 [0071.302] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.303] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.303] lstrlenW (lpString="SETUP.XML") returned 9 [0071.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.353] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=20577) returned 1 [0071.353] CloseHandle (hObject=0x1d0) returned 1 [0071.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0071.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.353] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.353] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0071.354] GetLastError () returned 0x0 [0071.354] ReadFile (in: hFile=0x1d0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x5061, lpOverlapped=0x0) returned 1 [0071.565] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0071.566] ReadFile (in: hFile=0x1d0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.566] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.566] SetEndOfFile (hFile=0x1c4) returned 1 [0071.567] CloseHandle (hObject=0x1c4) returned 1 [0071.567] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.567] SetEndOfFile (hFile=0x1d0) returned 1 [0071.568] CloseHandle (hObject=0x1d0) returned 1 [0071.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.568] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0071.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.568] lstrlenW (lpString=".doc") returned 4 [0071.568] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.568] lstrlenW (lpString=".docx") returned 5 [0071.568] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.568] lstrlenW (lpString=".pdf") returned 4 [0071.568] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString=".xls") returned 4 [0071.569] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString=".xlsx") returned 5 [0071.569] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.569] lstrlenW (lpString=".ppt") returned 4 [0071.569] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.569] lstrlenW (lpString=".zip") returned 4 [0071.569] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.569] lstrlenW (lpString=".rar") returned 4 [0071.569] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString=".bz2") returned 4 [0071.569] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString=".7z") returned 3 [0071.569] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.569] lstrlenW (lpString=".dbf") returned 4 [0071.569] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.569] lstrlenW (lpString=".1cd") returned 4 [0071.569] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.569] lstrlenW (lpString=".jpg") returned 4 [0071.569] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.569] lstrlenW (lpString=".doc") returned 4 [0071.569] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.569] lstrlenW (lpString=".docx") returned 5 [0071.569] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.570] lstrlenW (lpString=".pdf") returned 4 [0071.570] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.570] lstrlenW (lpString=".xls") returned 4 [0071.570] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.570] lstrlenW (lpString=".xlsx") returned 5 [0071.570] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.570] lstrlenW (lpString=".ppt") returned 4 [0071.570] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.570] lstrlenW (lpString=".zip") returned 4 [0071.570] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.570] lstrlenW (lpString=".rar") returned 4 [0071.570] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.570] lstrlenW (lpString=".bz2") returned 4 [0071.570] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.570] lstrlenW (lpString=".7z") returned 3 [0071.570] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.570] lstrlenW (lpString=".dbf") returned 4 [0071.570] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.570] lstrlenW (lpString=".1cd") returned 4 [0071.570] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0071.570] lstrlenW (lpString=".jpg") returned 4 [0071.570] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.571] lstrcmpiW (lpString1=".XML", lpString2=".beets") returned 1 [0071.571] lstrlenW (lpString="SETUP.XML") returned 9 [0071.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.660] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2424) returned 1 [0071.660] CloseHandle (hObject=0x19c) returned 1 [0071.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0071.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0071.660] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.660] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0071.660] GetLastError () returned 0x0 [0071.660] ReadFile (in: hFile=0x19c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x978, lpOverlapped=0x0) returned 1 [0071.816] WriteFile (in: hFile=0x18c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x980, lpOverlapped=0x0) returned 1 [0071.817] ReadFile (in: hFile=0x19c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.817] WriteFile (in: hFile=0x18c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.817] SetEndOfFile (hFile=0x18c) returned 1 [0071.818] CloseHandle (hObject=0x18c) returned 1 [0071.818] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.818] SetEndOfFile (hFile=0x19c) returned 1 [0071.819] CloseHandle (hObject=0x19c) returned 1 [0071.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.819] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0071.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.820] lstrlenW (lpString=".doc") returned 4 [0071.820] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.820] lstrlenW (lpString=".docx") returned 5 [0071.820] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.820] lstrlenW (lpString=".pdf") returned 4 [0071.820] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.820] lstrlenW (lpString=".xls") returned 4 [0071.820] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.820] lstrlenW (lpString=".xlsx") returned 5 [0071.820] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.820] lstrlenW (lpString=".ppt") returned 4 [0071.820] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.820] lstrlenW (lpString=".zip") returned 4 [0071.820] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.820] lstrlenW (lpString=".rar") returned 4 [0071.820] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString=".bz2") returned 4 [0071.821] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString=".7z") returned 3 [0071.821] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.821] lstrlenW (lpString=".dbf") returned 4 [0071.821] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.821] lstrlenW (lpString=".1cd") returned 4 [0071.821] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.821] lstrlenW (lpString=".jpg") returned 4 [0071.821] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.821] lstrlenW (lpString=".doc") returned 4 [0071.821] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString=".docx") returned 5 [0071.821] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0071.821] lstrlenW (lpString=".pdf") returned 4 [0071.821] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString=".xls") returned 4 [0071.821] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString=".xlsx") returned 5 [0071.821] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0071.821] lstrlenW (lpString=".ppt") returned 4 [0071.821] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.821] lstrlenW (lpString=".zip") returned 4 [0071.822] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0071.822] lstrlenW (lpString=".rar") returned 4 [0071.822] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0071.822] lstrlenW (lpString=".bz2") returned 4 [0071.822] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0071.822] lstrlenW (lpString=".7z") returned 3 [0071.822] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0071.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.822] lstrlenW (lpString=".dbf") returned 4 [0071.822] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0071.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.822] lstrlenW (lpString=".1cd") returned 4 [0071.822] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0071.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0071.822] lstrlenW (lpString=".jpg") returned 4 [0071.822] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0071.822] lstrcmpiW (lpString1=".DAT", lpString2=".beets") returned 1 [0071.822] lstrlenW (lpString="STOCKS.DAT") returned 10 [0071.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.891] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=39017) returned 1 [0071.891] CloseHandle (hObject=0x1a4) returned 1 [0071.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0071.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0071.892] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.892] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0071.892] GetLastError () returned 0x0 [0071.892] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x9869, lpOverlapped=0x0) returned 1 [0071.972] WriteFile (in: hFile=0x214, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0071.973] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.973] WriteFile (in: hFile=0x214, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0071.974] SetEndOfFile (hFile=0x214) returned 1 [0071.974] CloseHandle (hObject=0x214) returned 1 [0071.974] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.974] SetEndOfFile (hFile=0x1a4) returned 1 [0071.975] CloseHandle (hObject=0x1a4) returned 1 [0071.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0071.975] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0071.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.975] lstrlenW (lpString=".doc") returned 4 [0071.975] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0071.975] lstrlenW (lpString=".docx") returned 5 [0071.975] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0071.975] lstrlenW (lpString=".pdf") returned 4 [0071.975] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0071.975] lstrlenW (lpString=".xls") returned 4 [0071.975] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0071.975] lstrlenW (lpString=".xlsx") returned 5 [0071.975] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0071.975] lstrlenW (lpString=".ppt") returned 4 [0071.975] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0071.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.975] lstrlenW (lpString=".zip") returned 4 [0071.975] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString=".rar") returned 4 [0071.976] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString=".bz2") returned 4 [0071.976] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0071.976] lstrlenW (lpString=".7z") returned 3 [0071.976] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0071.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.976] lstrlenW (lpString=".dbf") returned 4 [0071.976] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.976] lstrlenW (lpString=".1cd") returned 4 [0071.976] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0071.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.976] lstrlenW (lpString=".jpg") returned 4 [0071.976] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.976] lstrlenW (lpString=".doc") returned 4 [0071.976] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString=".docx") returned 5 [0071.976] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0071.976] lstrlenW (lpString=".pdf") returned 4 [0071.976] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString=".xls") returned 4 [0071.976] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString=".xlsx") returned 5 [0071.976] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0071.976] lstrlenW (lpString=".ppt") returned 4 [0071.976] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.976] lstrlenW (lpString=".zip") returned 4 [0071.976] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString=".rar") returned 4 [0071.976] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0071.976] lstrlenW (lpString=".bz2") returned 4 [0071.976] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0071.977] lstrlenW (lpString=".7z") returned 3 [0071.977] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0071.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.977] lstrlenW (lpString=".dbf") returned 4 [0071.977] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0071.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.977] lstrlenW (lpString=".1cd") returned 4 [0071.977] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0071.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0071.977] lstrlenW (lpString=".jpg") returned 4 [0071.977] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0071.977] lstrcmpiW (lpString1=".TXT", lpString2=".beets") returned 1 [0071.977] lstrlenW (lpString="METCONV.TXT") returned 11 [0071.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.987] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1183416) returned 1 [0071.987] CloseHandle (hObject=0x1d0) returned 1 [0071.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0071.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.988] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.988] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0071.988] GetLastError () returned 0x0 [0071.988] ReadFile (in: hFile=0x1d0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0072.066] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0072.080] ReadFile (in: hFile=0x1d0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0072.224] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0072.231] ReadFile (in: hFile=0x1d0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.231] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.231] SetEndOfFile (hFile=0x1c4) returned 1 [0072.231] CloseHandle (hObject=0x1c4) returned 1 [0072.247] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.247] SetEndOfFile (hFile=0x1d0) returned 1 [0072.247] CloseHandle (hObject=0x1d0) returned 1 [0072.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0072.248] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0072.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.248] lstrlenW (lpString=".doc") returned 4 [0072.248] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0072.248] lstrlenW (lpString=".docx") returned 5 [0072.248] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0072.248] lstrlenW (lpString=".pdf") returned 4 [0072.248] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0072.248] lstrlenW (lpString=".xls") returned 4 [0072.248] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0072.248] lstrlenW (lpString=".xlsx") returned 5 [0072.249] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0072.249] lstrlenW (lpString=".ppt") returned 4 [0072.249] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.249] lstrlenW (lpString=".zip") returned 4 [0072.249] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0072.249] lstrlenW (lpString=".rar") returned 4 [0072.249] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString=".bz2") returned 4 [0072.249] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString=".7z") returned 3 [0072.249] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0072.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.249] lstrlenW (lpString=".dbf") returned 4 [0072.249] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.249] lstrlenW (lpString=".1cd") returned 4 [0072.249] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.249] lstrlenW (lpString=".jpg") returned 4 [0072.249] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.249] lstrlenW (lpString=".doc") returned 4 [0072.249] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString=".docx") returned 5 [0072.249] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0072.249] lstrlenW (lpString=".pdf") returned 4 [0072.249] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString=".xls") returned 4 [0072.249] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0072.249] lstrlenW (lpString=".xlsx") returned 5 [0072.249] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0072.249] lstrlenW (lpString=".ppt") returned 4 [0072.249] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0072.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.250] lstrlenW (lpString=".zip") returned 4 [0072.250] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0072.250] lstrlenW (lpString=".rar") returned 4 [0072.250] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0072.250] lstrlenW (lpString=".bz2") returned 4 [0072.250] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0072.250] lstrlenW (lpString=".7z") returned 3 [0072.250] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0072.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.250] lstrlenW (lpString=".dbf") returned 4 [0072.250] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0072.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.250] lstrlenW (lpString=".1cd") returned 4 [0072.250] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0072.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0072.250] lstrlenW (lpString=".jpg") returned 4 [0072.250] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0072.250] lstrcmpiW (lpString1=".jpg", lpString2=".beets") returned 1 [0072.250] lstrlenW (lpString="Notebook.jpg") returned 12 [0072.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0072.635] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2950) returned 1 [0072.635] CloseHandle (hObject=0x1b4) returned 1 [0072.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0072.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.636] lstrlenW (lpString=".doc") returned 4 [0072.636] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.636] lstrlenW (lpString=".docx") returned 5 [0072.636] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0072.636] lstrlenW (lpString=".pdf") returned 4 [0072.636] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.636] lstrlenW (lpString=".xls") returned 4 [0072.636] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.636] lstrlenW (lpString=".xlsx") returned 5 [0072.636] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0072.636] lstrlenW (lpString=".ppt") returned 4 [0072.636] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.636] lstrlenW (lpString=".zip") returned 4 [0072.636] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.636] lstrlenW (lpString=".rar") returned 4 [0072.636] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.636] lstrlenW (lpString=".bz2") returned 4 [0072.636] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.636] lstrlenW (lpString=".7z") returned 3 [0072.636] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.636] lstrlenW (lpString=".dbf") returned 4 [0072.636] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.636] lstrlenW (lpString=".1cd") returned 4 [0072.636] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.637] lstrlenW (lpString=".jpg") returned 4 [0072.637] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.637] lstrlenW (lpString=".doc") returned 4 [0072.637] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0072.637] lstrlenW (lpString=".docx") returned 5 [0072.637] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0072.637] lstrlenW (lpString=".pdf") returned 4 [0072.637] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0072.637] lstrlenW (lpString=".xls") returned 4 [0072.637] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0072.637] lstrlenW (lpString=".xlsx") returned 5 [0072.637] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0072.637] lstrlenW (lpString=".ppt") returned 4 [0072.637] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0072.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.637] lstrlenW (lpString=".zip") returned 4 [0072.637] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0072.637] lstrlenW (lpString=".rar") returned 4 [0072.637] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0072.637] lstrlenW (lpString=".bz2") returned 4 [0072.637] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0072.637] lstrlenW (lpString=".7z") returned 3 [0072.637] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0072.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.637] lstrlenW (lpString=".dbf") returned 4 [0072.637] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0072.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.637] lstrlenW (lpString=".1cd") returned 4 [0072.637] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0072.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0072.638] lstrlenW (lpString=".jpg") returned 4 [0072.638] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0072.638] lstrcmpiW (lpString1=".PNG", lpString2=".beets") returned 1 [0072.638] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0073.202] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=19780) returned 1 [0073.202] CloseHandle (hObject=0x178) returned 1 [0073.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0073.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0073.202] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.203] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0073.203] GetLastError () returned 0x0 [0073.203] ReadFile (in: hFile=0x178, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0073.245] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0073.246] ReadFile (in: hFile=0x178, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.246] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.246] SetEndOfFile (hFile=0x190) returned 1 [0073.247] CloseHandle (hObject=0x190) returned 1 [0073.247] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.247] SetEndOfFile (hFile=0x178) returned 1 [0073.248] CloseHandle (hObject=0x178) returned 1 [0073.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0073.248] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0073.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.249] lstrlenW (lpString=".doc") returned 4 [0073.249] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0073.249] lstrlenW (lpString=".docx") returned 5 [0073.249] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0073.249] lstrlenW (lpString=".pdf") returned 4 [0073.249] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0073.249] lstrlenW (lpString=".xls") returned 4 [0073.249] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0073.249] lstrlenW (lpString=".xlsx") returned 5 [0073.249] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0073.249] lstrlenW (lpString=".ppt") returned 4 [0073.249] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0073.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.249] lstrlenW (lpString=".zip") returned 4 [0073.249] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0073.249] lstrlenW (lpString=".rar") returned 4 [0073.249] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0073.249] lstrlenW (lpString=".bz2") returned 4 [0073.249] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0073.249] lstrlenW (lpString=".7z") returned 3 [0073.249] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0073.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.249] lstrlenW (lpString=".dbf") returned 4 [0073.249] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0073.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.249] lstrlenW (lpString=".1cd") returned 4 [0073.249] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0073.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.250] lstrlenW (lpString=".jpg") returned 4 [0073.250] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0073.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.250] lstrlenW (lpString=".doc") returned 4 [0073.250] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0073.250] lstrlenW (lpString=".docx") returned 5 [0073.250] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0073.250] lstrlenW (lpString=".pdf") returned 4 [0073.250] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0073.250] lstrlenW (lpString=".xls") returned 4 [0073.250] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0073.250] lstrlenW (lpString=".xlsx") returned 5 [0073.250] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0073.250] lstrlenW (lpString=".ppt") returned 4 [0073.250] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0073.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.250] lstrlenW (lpString=".zip") returned 4 [0073.250] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0073.250] lstrlenW (lpString=".rar") returned 4 [0073.250] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0073.250] lstrlenW (lpString=".bz2") returned 4 [0073.250] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0073.250] lstrlenW (lpString=".7z") returned 3 [0073.250] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0073.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.250] lstrlenW (lpString=".dbf") returned 4 [0073.250] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0073.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.251] lstrlenW (lpString=".1cd") returned 4 [0073.251] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0073.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0073.251] lstrlenW (lpString=".jpg") returned 4 [0073.251] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0073.251] lstrcmpiW (lpString1=".GIF", lpString2=".beets") returned 1 [0073.251] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0073.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0073.251] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2848) returned 1 [0073.252] CloseHandle (hObject=0x178) returned 1 [0073.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0073.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0073.252] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.252] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0073.728] GetLastError () returned 0x0 [0073.728] ReadFile (in: hFile=0x178, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0xb20, lpOverlapped=0x0) returned 1 [0073.829] WriteFile (in: hFile=0x16c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0073.830] ReadFile (in: hFile=0x178, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.831] WriteFile (in: hFile=0x16c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0073.831] SetEndOfFile (hFile=0x16c) returned 1 [0073.831] CloseHandle (hObject=0x16c) returned 1 [0073.831] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.831] SetEndOfFile (hFile=0x178) returned 1 [0073.832] CloseHandle (hObject=0x178) returned 1 [0073.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x20) returned 1 [0073.832] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0073.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.833] lstrlenW (lpString=".doc") returned 4 [0073.833] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.833] lstrlenW (lpString=".docx") returned 5 [0073.833] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0073.833] lstrlenW (lpString=".pdf") returned 4 [0073.833] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.833] lstrlenW (lpString=".xls") returned 4 [0073.833] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.833] lstrlenW (lpString=".xlsx") returned 5 [0073.833] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0073.833] lstrlenW (lpString=".ppt") returned 4 [0073.833] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.833] lstrlenW (lpString=".zip") returned 4 [0073.833] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.833] lstrlenW (lpString=".rar") returned 4 [0073.833] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.833] lstrlenW (lpString=".bz2") returned 4 [0073.833] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.833] lstrlenW (lpString=".7z") returned 3 [0073.833] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.833] lstrlenW (lpString=".dbf") returned 4 [0073.834] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.834] lstrlenW (lpString=".1cd") returned 4 [0073.834] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.834] lstrlenW (lpString=".jpg") returned 4 [0073.834] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.834] lstrlenW (lpString=".doc") returned 4 [0073.834] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.834] lstrlenW (lpString=".docx") returned 5 [0073.834] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0073.834] lstrlenW (lpString=".pdf") returned 4 [0073.834] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.834] lstrlenW (lpString=".xls") returned 4 [0073.834] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.834] lstrlenW (lpString=".xlsx") returned 5 [0073.834] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0073.834] lstrlenW (lpString=".ppt") returned 4 [0073.834] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.835] lstrlenW (lpString=".zip") returned 4 [0073.835] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.835] lstrlenW (lpString=".rar") returned 4 [0073.835] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.835] lstrlenW (lpString=".bz2") returned 4 [0073.835] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.835] lstrlenW (lpString=".7z") returned 3 [0073.835] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.835] lstrlenW (lpString=".dbf") returned 4 [0073.835] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.835] lstrlenW (lpString=".1cd") returned 4 [0073.835] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0073.835] lstrlenW (lpString=".jpg") returned 4 [0073.835] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.836] lstrcmpiW (lpString1=".PNG", lpString2=".beets") returned 1 [0073.836] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0073.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.166] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=33009) returned 1 [0074.166] CloseHandle (hObject=0x180) returned 1 [0074.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0074.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0074.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.166] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.166] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0074.167] GetLastError () returned 0x0 [0074.167] ReadFile (hFile=0x180, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0) Thread: id = 17 os_tid = 0xa78 [0051.646] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x38e06b0 [0051.646] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10000) returned 0x38f06b8 [0051.647] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630420 [0051.647] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x6330e0 [0051.647] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630438 [0051.647] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x100000) returned 0x3db0020 [0051.647] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630450 [0051.647] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630450, Size=0x20) returned 0x65fe78 [0051.647] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x630450 [0051.647] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x630450, Size=0x20) returned 0x65fec8 [0051.648] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0051.648] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0051.648] Wow64DisableWow64FsRedirection (in: OldValue=0x32bff58 | out: OldValue=0x32bff58*=0x0) returned 1 [0051.648] lstrlenW (lpString="kernel32.dll") returned 12 [0051.648] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fe78 | out: hHeap=0x5e0000) returned 1 [0051.648] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0051.648] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x65fec8 | out: hHeap=0x5e0000) returned 1 [0051.648] Sleep (dwMilliseconds=0x64) [0051.785] lstrcmpiW (lpString1=".ttf", lpString2=".beets") returned 1 [0051.785] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0051.785] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.794] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=1984228) returned 1 [0051.794] CloseHandle (hObject=0x168) returned 1 [0051.794] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0051.794] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.794] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[vombombom@cock.li].beets")) returned 0 [0051.794] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.794] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.794] lstrlenW (lpString=".doc") returned 4 [0051.794] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0051.794] lstrlenW (lpString=".docx") returned 5 [0051.794] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0051.794] lstrlenW (lpString=".pdf") returned 4 [0051.794] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0051.794] lstrlenW (lpString=".xls") returned 4 [0051.794] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0051.794] lstrlenW (lpString=".xlsx") returned 5 [0051.794] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0051.794] lstrlenW (lpString=".ppt") returned 4 [0051.794] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0051.794] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.794] lstrlenW (lpString=".zip") returned 4 [0051.795] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0051.795] lstrlenW (lpString=".rar") returned 4 [0051.795] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0051.795] lstrlenW (lpString=".bz2") returned 4 [0051.795] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0051.795] lstrlenW (lpString=".7z") returned 3 [0051.795] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0051.795] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.795] lstrlenW (lpString=".dbf") returned 4 [0051.795] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0051.795] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.795] lstrlenW (lpString=".1cd") returned 4 [0051.795] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0051.795] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.795] lstrlenW (lpString=".jpg") returned 4 [0051.795] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0051.795] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.795] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.795] lstrlenW (lpString=".doc") returned 4 [0051.795] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0051.795] lstrlenW (lpString=".docx") returned 5 [0051.796] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0051.796] lstrlenW (lpString=".pdf") returned 4 [0051.796] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0051.796] lstrlenW (lpString=".xls") returned 4 [0051.796] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0051.796] lstrlenW (lpString=".xlsx") returned 5 [0051.796] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0051.796] lstrlenW (lpString=".ppt") returned 4 [0051.796] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0051.796] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.796] lstrlenW (lpString=".zip") returned 4 [0051.796] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0051.796] lstrlenW (lpString=".rar") returned 4 [0051.796] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0051.796] lstrlenW (lpString=".bz2") returned 4 [0051.796] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0051.796] lstrlenW (lpString=".7z") returned 3 [0051.796] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0051.796] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.796] lstrlenW (lpString=".dbf") returned 4 [0051.796] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0051.796] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.796] lstrlenW (lpString=".1cd") returned 4 [0051.796] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0051.796] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0051.797] lstrlenW (lpString=".jpg") returned 4 [0051.797] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0051.797] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.797] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.797] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.797] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=88144) returned 1 [0051.797] CloseHandle (hObject=0x168) returned 1 [0051.797] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0051.797] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.797] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.797] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.797] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.797] lstrlenW (lpString=".doc") returned 4 [0051.797] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.797] lstrlenW (lpString=".docx") returned 5 [0051.798] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.798] lstrlenW (lpString=".pdf") returned 4 [0051.798] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.798] lstrlenW (lpString=".xls") returned 4 [0051.798] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.798] lstrlenW (lpString=".xlsx") returned 5 [0051.798] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.798] lstrlenW (lpString=".ppt") returned 4 [0051.798] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.798] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.798] lstrlenW (lpString=".zip") returned 4 [0051.798] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.798] lstrlenW (lpString=".rar") returned 4 [0051.798] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.798] lstrlenW (lpString=".bz2") returned 4 [0051.798] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.798] lstrlenW (lpString=".7z") returned 3 [0051.798] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.798] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.798] lstrlenW (lpString=".dbf") returned 4 [0051.798] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.798] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.798] lstrlenW (lpString=".1cd") returned 4 [0051.798] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.798] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.798] lstrlenW (lpString=".jpg") returned 4 [0051.798] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.798] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.798] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.798] lstrlenW (lpString=".doc") returned 4 [0051.798] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.798] lstrlenW (lpString=".docx") returned 5 [0051.799] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.799] lstrlenW (lpString=".pdf") returned 4 [0051.799] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.799] lstrlenW (lpString=".xls") returned 4 [0051.799] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.799] lstrlenW (lpString=".xlsx") returned 5 [0051.799] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.799] lstrlenW (lpString=".ppt") returned 4 [0051.799] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.799] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.799] lstrlenW (lpString=".zip") returned 4 [0051.799] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.799] lstrlenW (lpString=".rar") returned 4 [0051.799] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.799] lstrlenW (lpString=".bz2") returned 4 [0051.799] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.799] lstrlenW (lpString=".7z") returned 3 [0051.799] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.799] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.799] lstrlenW (lpString=".dbf") returned 4 [0051.799] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.799] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.799] lstrlenW (lpString=".1cd") returned 4 [0051.799] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.799] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0051.799] lstrlenW (lpString=".jpg") returned 4 [0051.799] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.800] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.800] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.800] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.800] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=90704) returned 1 [0051.800] CloseHandle (hObject=0x168) returned 1 [0051.800] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0051.800] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.800] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.800] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.800] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.800] lstrlenW (lpString=".doc") returned 4 [0051.801] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.801] lstrlenW (lpString=".docx") returned 5 [0051.801] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.801] lstrlenW (lpString=".pdf") returned 4 [0051.801] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.801] lstrlenW (lpString=".xls") returned 4 [0051.801] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.801] lstrlenW (lpString=".xlsx") returned 5 [0051.801] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.801] lstrlenW (lpString=".ppt") returned 4 [0051.801] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.801] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.801] lstrlenW (lpString=".zip") returned 4 [0051.801] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.801] lstrlenW (lpString=".rar") returned 4 [0051.801] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.801] lstrlenW (lpString=".bz2") returned 4 [0051.801] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.801] lstrlenW (lpString=".7z") returned 3 [0051.801] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.801] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.801] lstrlenW (lpString=".dbf") returned 4 [0051.801] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.801] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.801] lstrlenW (lpString=".1cd") returned 4 [0051.801] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.801] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.801] lstrlenW (lpString=".jpg") returned 4 [0051.801] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.801] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.802] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.802] lstrlenW (lpString=".doc") returned 4 [0051.802] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.802] lstrlenW (lpString=".docx") returned 5 [0051.802] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.802] lstrlenW (lpString=".pdf") returned 4 [0051.802] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.802] lstrlenW (lpString=".xls") returned 4 [0051.802] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.802] lstrlenW (lpString=".xlsx") returned 5 [0051.802] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.802] lstrlenW (lpString=".ppt") returned 4 [0051.802] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.802] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.802] lstrlenW (lpString=".zip") returned 4 [0051.802] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.802] lstrlenW (lpString=".rar") returned 4 [0051.802] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.802] lstrlenW (lpString=".bz2") returned 4 [0051.802] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.802] lstrlenW (lpString=".7z") returned 3 [0051.802] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.802] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.802] lstrlenW (lpString=".dbf") returned 4 [0051.802] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.802] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.802] lstrlenW (lpString=".1cd") returned 4 [0051.802] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.802] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0051.802] lstrlenW (lpString=".jpg") returned 4 [0051.802] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.802] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.802] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.803] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.803] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=90704) returned 1 [0051.803] CloseHandle (hObject=0x168) returned 1 [0051.803] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0051.803] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.803] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.803] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.803] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.803] lstrlenW (lpString=".doc") returned 4 [0051.803] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.803] lstrlenW (lpString=".docx") returned 5 [0051.803] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.803] lstrlenW (lpString=".pdf") returned 4 [0051.803] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.803] lstrlenW (lpString=".xls") returned 4 [0051.803] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.803] lstrlenW (lpString=".xlsx") returned 5 [0051.803] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.803] lstrlenW (lpString=".ppt") returned 4 [0051.804] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.804] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.804] lstrlenW (lpString=".zip") returned 4 [0051.804] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.804] lstrlenW (lpString=".rar") returned 4 [0051.804] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.804] lstrlenW (lpString=".bz2") returned 4 [0051.804] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.804] lstrlenW (lpString=".7z") returned 3 [0051.804] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.804] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.804] lstrlenW (lpString=".dbf") returned 4 [0051.804] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.804] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.804] lstrlenW (lpString=".1cd") returned 4 [0051.804] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.804] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.804] lstrlenW (lpString=".jpg") returned 4 [0051.804] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.804] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.804] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.804] lstrlenW (lpString=".doc") returned 4 [0051.804] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.804] lstrlenW (lpString=".docx") returned 5 [0051.804] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.804] lstrlenW (lpString=".pdf") returned 4 [0051.805] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.805] lstrlenW (lpString=".xls") returned 4 [0051.805] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.805] lstrlenW (lpString=".xlsx") returned 5 [0051.805] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.805] lstrlenW (lpString=".ppt") returned 4 [0051.805] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.805] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.805] lstrlenW (lpString=".zip") returned 4 [0051.805] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.805] lstrlenW (lpString=".rar") returned 4 [0051.805] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.805] lstrlenW (lpString=".bz2") returned 4 [0051.805] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.805] lstrlenW (lpString=".7z") returned 3 [0051.805] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.805] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.805] lstrlenW (lpString=".dbf") returned 4 [0051.806] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.806] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.806] lstrlenW (lpString=".1cd") returned 4 [0051.806] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.806] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0051.806] lstrlenW (lpString=".jpg") returned 4 [0051.806] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.806] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.806] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.806] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.806] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=90176) returned 1 [0051.806] CloseHandle (hObject=0x168) returned 1 [0051.806] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0051.807] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.807] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.807] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.807] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.807] lstrlenW (lpString=".doc") returned 4 [0051.807] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.807] lstrlenW (lpString=".docx") returned 5 [0051.807] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.807] lstrlenW (lpString=".pdf") returned 4 [0051.807] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.807] lstrlenW (lpString=".xls") returned 4 [0051.807] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.807] lstrlenW (lpString=".xlsx") returned 5 [0051.807] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.807] lstrlenW (lpString=".ppt") returned 4 [0051.807] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.807] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.807] lstrlenW (lpString=".zip") returned 4 [0051.807] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.808] lstrlenW (lpString=".rar") returned 4 [0051.808] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.808] lstrlenW (lpString=".bz2") returned 4 [0051.808] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.808] lstrlenW (lpString=".7z") returned 3 [0051.808] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.808] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.808] lstrlenW (lpString=".dbf") returned 4 [0051.808] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.808] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.808] lstrlenW (lpString=".1cd") returned 4 [0051.808] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.808] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.808] lstrlenW (lpString=".jpg") returned 4 [0051.808] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.808] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.808] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.808] lstrlenW (lpString=".doc") returned 4 [0051.808] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.808] lstrlenW (lpString=".docx") returned 5 [0051.808] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.808] lstrlenW (lpString=".pdf") returned 4 [0051.808] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.809] lstrlenW (lpString=".xls") returned 4 [0051.809] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.809] lstrlenW (lpString=".xlsx") returned 5 [0051.809] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.809] lstrlenW (lpString=".ppt") returned 4 [0051.809] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.809] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.809] lstrlenW (lpString=".zip") returned 4 [0051.809] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.809] lstrlenW (lpString=".rar") returned 4 [0051.809] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.809] lstrlenW (lpString=".bz2") returned 4 [0051.809] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.809] lstrlenW (lpString=".7z") returned 3 [0051.809] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.809] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.809] lstrlenW (lpString=".dbf") returned 4 [0051.809] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.809] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.809] lstrlenW (lpString=".1cd") returned 4 [0051.809] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.809] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0051.809] lstrlenW (lpString=".jpg") returned 4 [0051.809] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.810] lstrcmpiW (lpString1=".mui", lpString2=".beets") returned 1 [0051.810] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0051.810] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0051.810] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=89664) returned 1 [0051.810] CloseHandle (hObject=0x168) returned 1 [0051.810] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0051.810] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0051.810] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.810] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.810] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.810] lstrlenW (lpString=".doc") returned 4 [0051.811] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.811] lstrlenW (lpString=".docx") returned 5 [0051.811] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.811] lstrlenW (lpString=".pdf") returned 4 [0051.811] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.811] lstrlenW (lpString=".xls") returned 4 [0051.811] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.811] lstrlenW (lpString=".xlsx") returned 5 [0051.811] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.811] lstrlenW (lpString=".ppt") returned 4 [0051.811] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.811] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.811] lstrlenW (lpString=".zip") returned 4 [0051.811] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.811] lstrlenW (lpString=".rar") returned 4 [0051.811] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.811] lstrlenW (lpString=".bz2") returned 4 [0051.811] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.811] lstrlenW (lpString=".7z") returned 3 [0051.811] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.811] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.811] lstrlenW (lpString=".dbf") returned 4 [0051.811] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.811] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.811] lstrlenW (lpString=".1cd") returned 4 [0051.811] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.811] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.811] lstrlenW (lpString=".jpg") returned 4 [0051.812] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.812] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.812] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.812] lstrlenW (lpString=".doc") returned 4 [0051.812] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0051.812] lstrlenW (lpString=".docx") returned 5 [0051.812] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0051.812] lstrlenW (lpString=".pdf") returned 4 [0051.812] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0051.812] lstrlenW (lpString=".xls") returned 4 [0051.812] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0051.812] lstrlenW (lpString=".xlsx") returned 5 [0051.812] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0051.812] lstrlenW (lpString=".ppt") returned 4 [0051.812] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0051.812] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.812] lstrlenW (lpString=".zip") returned 4 [0051.812] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0051.812] lstrlenW (lpString=".rar") returned 4 [0051.812] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0051.812] lstrlenW (lpString=".bz2") returned 4 [0051.812] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0051.812] lstrlenW (lpString=".7z") returned 3 [0051.812] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0051.812] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.812] lstrlenW (lpString=".dbf") returned 4 [0051.812] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0051.813] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.813] lstrlenW (lpString=".1cd") returned 4 [0051.813] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0051.813] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0051.813] lstrlenW (lpString=".jpg") returned 4 [0051.813] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0051.813] Sleep (dwMilliseconds=0x64) [0052.244] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0052.244] lstrlenW (lpString="ExcelLR.cab") returned 11 [0052.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0052.264] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=16972987) returned 1 [0052.264] CloseHandle (hObject=0x180) returned 1 [0052.264] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0052.264] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0052.265] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0052.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0052.265] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.265] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.265] ReadFile (in: hFile=0x180, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.291] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.291] ReadFile (in: hFile=0x180, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.338] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.338] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.338] ReadFile (in: hFile=0x180, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.479] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.479] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0052.499] SetEndOfFile (hFile=0x180) returned 1 [0052.499] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3ef3078 [0052.504] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.504] WriteFile (in: hFile=0x180, lpBuffer=0x3ef3078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3078*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.505] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x180, lpBuffer=0x3ef3078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3078*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.506] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x180, lpBuffer=0x3ef3078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3078*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.586] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ef3078 | out: hHeap=0x5e0000) returned 1 [0052.586] CloseHandle (hObject=0x180) returned 1 [0055.009] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0055.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.010] lstrlenW (lpString=".doc") returned 4 [0055.010] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.010] lstrlenW (lpString=".docx") returned 5 [0055.010] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.010] lstrlenW (lpString=".pdf") returned 4 [0055.010] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.010] lstrlenW (lpString=".xls") returned 4 [0055.010] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.010] lstrlenW (lpString=".xlsx") returned 5 [0055.010] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.010] lstrlenW (lpString=".ppt") returned 4 [0055.010] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.010] lstrlenW (lpString=".zip") returned 4 [0055.010] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.010] lstrlenW (lpString=".rar") returned 4 [0055.010] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.010] lstrlenW (lpString=".bz2") returned 4 [0055.068] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.068] lstrlenW (lpString=".7z") returned 3 [0055.068] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.068] lstrlenW (lpString=".dbf") returned 4 [0055.068] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.068] lstrlenW (lpString=".1cd") returned 4 [0055.068] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.068] lstrlenW (lpString=".jpg") returned 4 [0055.069] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.069] lstrlenW (lpString=".doc") returned 4 [0055.069] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.069] lstrlenW (lpString=".docx") returned 5 [0055.069] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.069] lstrlenW (lpString=".pdf") returned 4 [0055.069] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.069] lstrlenW (lpString=".xls") returned 4 [0055.069] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.069] lstrlenW (lpString=".xlsx") returned 5 [0055.069] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.069] lstrlenW (lpString=".ppt") returned 4 [0055.069] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.069] lstrlenW (lpString=".zip") returned 4 [0055.069] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.069] lstrlenW (lpString=".rar") returned 4 [0055.069] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.069] lstrlenW (lpString=".bz2") returned 4 [0055.069] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.069] lstrlenW (lpString=".7z") returned 3 [0055.069] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.069] lstrlenW (lpString=".dbf") returned 4 [0055.069] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.070] lstrlenW (lpString=".1cd") returned 4 [0055.070] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0055.070] lstrlenW (lpString=".jpg") returned 4 [0055.070] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.070] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0055.070] lstrlenW (lpString="PubLR.cab") returned 9 [0055.070] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.070] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=9958388) returned 1 [0055.070] CloseHandle (hObject=0x180) returned 1 [0055.070] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0055.070] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0055.071] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0055.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.071] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0055.071] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.071] ReadFile (in: hFile=0x180, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.233] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.233] ReadFile (in: hFile=0x180, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.837] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.837] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.837] ReadFile (in: hFile=0x180, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.622] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.622] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0056.639] SetEndOfFile (hFile=0x180) returned 1 [0056.639] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f6e0b0 [0056.687] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.687] WriteFile (in: hFile=0x180, lpBuffer=0x3f6e0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f6e0b0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.689] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.689] WriteFile (in: hFile=0x180, lpBuffer=0x3f6e0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f6e0b0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.696] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.696] WriteFile (in: hFile=0x180, lpBuffer=0x3f6e0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f6e0b0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.701] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f6e0b0 | out: hHeap=0x5e0000) returned 1 [0056.701] CloseHandle (hObject=0x180) returned 1 [0058.638] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0058.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.638] lstrlenW (lpString=".doc") returned 4 [0058.638] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.638] lstrlenW (lpString=".docx") returned 5 [0058.638] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0058.638] lstrlenW (lpString=".pdf") returned 4 [0058.638] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.638] lstrlenW (lpString=".xls") returned 4 [0058.638] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.639] lstrlenW (lpString=".xlsx") returned 5 [0058.639] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0058.639] lstrlenW (lpString=".ppt") returned 4 [0058.639] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.639] lstrlenW (lpString=".zip") returned 4 [0058.639] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.639] lstrlenW (lpString=".rar") returned 4 [0058.639] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.639] lstrlenW (lpString=".bz2") returned 4 [0058.639] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.639] lstrlenW (lpString=".7z") returned 3 [0058.639] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.639] lstrlenW (lpString=".dbf") returned 4 [0058.639] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.639] lstrlenW (lpString=".1cd") returned 4 [0058.639] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.639] lstrlenW (lpString=".jpg") returned 4 [0058.639] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.639] lstrlenW (lpString=".doc") returned 4 [0058.639] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.639] lstrlenW (lpString=".docx") returned 5 [0058.640] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0058.640] lstrlenW (lpString=".pdf") returned 4 [0058.640] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.640] lstrlenW (lpString=".xls") returned 4 [0058.640] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.640] lstrlenW (lpString=".xlsx") returned 5 [0058.640] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0058.640] lstrlenW (lpString=".ppt") returned 4 [0058.640] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.640] lstrlenW (lpString=".zip") returned 4 [0058.640] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.640] lstrlenW (lpString=".rar") returned 4 [0058.640] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.640] lstrlenW (lpString=".bz2") returned 4 [0058.640] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.640] lstrlenW (lpString=".7z") returned 3 [0058.640] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.640] lstrlenW (lpString=".dbf") returned 4 [0058.640] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.640] lstrlenW (lpString=".1cd") returned 4 [0058.640] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0058.640] lstrlenW (lpString=".jpg") returned 4 [0058.640] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.641] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0058.641] lstrlenW (lpString="Proof.cab") returned 9 [0058.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.641] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=11482605) returned 1 [0058.641] CloseHandle (hObject=0x180) returned 1 [0058.641] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0058.641] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0058.641] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0059.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.070] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0059.070] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.070] ReadFile (in: hFile=0x180, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.453] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.453] ReadFile (in: hFile=0x180, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.714] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.714] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.714] ReadFile (in: hFile=0x180, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.793] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.793] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0059.805] SetEndOfFile (hFile=0x180) returned 1 [0059.806] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0059.810] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.810] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.811] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.811] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.812] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.812] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.815] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0059.815] CloseHandle (hObject=0x180) returned 1 [0061.855] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0061.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.856] lstrlenW (lpString=".doc") returned 4 [0061.856] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.856] lstrlenW (lpString=".docx") returned 5 [0061.856] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0061.856] lstrlenW (lpString=".pdf") returned 4 [0061.856] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.856] lstrlenW (lpString=".xls") returned 4 [0061.856] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.856] lstrlenW (lpString=".xlsx") returned 5 [0061.856] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0061.856] lstrlenW (lpString=".ppt") returned 4 [0061.856] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.856] lstrlenW (lpString=".zip") returned 4 [0061.856] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.856] lstrlenW (lpString=".rar") returned 4 [0061.856] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.857] lstrlenW (lpString=".bz2") returned 4 [0061.857] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.857] lstrlenW (lpString=".7z") returned 3 [0061.857] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.857] lstrlenW (lpString=".dbf") returned 4 [0061.857] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.857] lstrlenW (lpString=".1cd") returned 4 [0061.857] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.857] lstrlenW (lpString=".jpg") returned 4 [0061.857] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.857] lstrlenW (lpString=".doc") returned 4 [0061.857] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.857] lstrlenW (lpString=".docx") returned 5 [0061.857] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0061.858] lstrlenW (lpString=".pdf") returned 4 [0061.858] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.858] lstrlenW (lpString=".xls") returned 4 [0061.858] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.858] lstrlenW (lpString=".xlsx") returned 5 [0061.858] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0061.858] lstrlenW (lpString=".ppt") returned 4 [0061.858] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.858] lstrlenW (lpString=".zip") returned 4 [0061.858] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.858] lstrlenW (lpString=".rar") returned 4 [0061.858] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.858] lstrlenW (lpString=".bz2") returned 4 [0061.858] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.858] lstrlenW (lpString=".7z") returned 3 [0061.858] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.858] lstrlenW (lpString=".dbf") returned 4 [0061.858] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.858] lstrlenW (lpString=".1cd") returned 4 [0061.858] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0061.858] lstrlenW (lpString=".jpg") returned 4 [0061.858] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.858] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0061.859] lstrlenW (lpString="Office32MUI.msi") returned 15 [0061.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.859] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=873984) returned 1 [0061.859] CloseHandle (hObject=0x180) returned 1 [0061.859] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0061.859] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0061.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.859] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.859] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.860] GetLastError () returned 0x0 [0061.860] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xd5600, lpOverlapped=0x0) returned 1 [0067.636] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0067.646] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0067.646] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0067.647] SetEndOfFile (hFile=0x20c) returned 1 [0067.647] CloseHandle (hObject=0x20c) returned 1 [0067.653] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.653] SetEndOfFile (hFile=0x180) returned 1 [0067.666] CloseHandle (hObject=0x180) returned 1 [0067.667] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0067.667] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0067.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.667] lstrlenW (lpString=".doc") returned 4 [0067.667] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0067.667] lstrlenW (lpString=".docx") returned 5 [0067.667] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0067.667] lstrlenW (lpString=".pdf") returned 4 [0067.667] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0067.667] lstrlenW (lpString=".xls") returned 4 [0067.667] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0067.667] lstrlenW (lpString=".xlsx") returned 5 [0067.667] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0067.667] lstrlenW (lpString=".ppt") returned 4 [0067.667] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0067.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.667] lstrlenW (lpString=".zip") returned 4 [0067.667] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0067.667] lstrlenW (lpString=".rar") returned 4 [0067.667] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0067.667] lstrlenW (lpString=".bz2") returned 4 [0067.668] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0067.668] lstrlenW (lpString=".7z") returned 3 [0067.668] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0067.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.668] lstrlenW (lpString=".dbf") returned 4 [0067.668] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0067.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.668] lstrlenW (lpString=".1cd") returned 4 [0067.668] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0067.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.668] lstrlenW (lpString=".jpg") returned 4 [0067.668] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0067.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.668] lstrlenW (lpString=".doc") returned 4 [0067.668] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0067.668] lstrlenW (lpString=".docx") returned 5 [0067.668] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0067.668] lstrlenW (lpString=".pdf") returned 4 [0067.668] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0067.668] lstrlenW (lpString=".xls") returned 4 [0067.668] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0067.668] lstrlenW (lpString=".xlsx") returned 5 [0067.668] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0067.668] lstrlenW (lpString=".ppt") returned 4 [0067.668] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0067.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.668] lstrlenW (lpString=".zip") returned 4 [0067.668] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0067.668] lstrlenW (lpString=".rar") returned 4 [0067.668] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0067.668] lstrlenW (lpString=".bz2") returned 4 [0067.668] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0067.668] lstrlenW (lpString=".7z") returned 3 [0067.668] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0067.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.669] lstrlenW (lpString=".dbf") returned 4 [0067.669] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0067.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.669] lstrlenW (lpString=".1cd") returned 4 [0067.669] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0067.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0067.669] lstrlenW (lpString=".jpg") returned 4 [0067.669] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0067.669] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0067.669] lstrlenW (lpString="InfLR.cab") returned 9 [0067.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.669] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=18874884) returned 1 [0067.669] CloseHandle (hObject=0x180) returned 1 [0067.669] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0067.670] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0067.670] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0067.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.671] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0067.671] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0067.671] ReadFile (in: hFile=0x180, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.587] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0068.587] ReadFile (in: hFile=0x180, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.901] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0068.901] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0068.901] ReadFile (in: hFile=0x180, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.333] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.333] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0069.721] SetEndOfFile (hFile=0x180) returned 1 [0069.721] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84098 [0069.725] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.725] WriteFile (in: hFile=0x180, lpBuffer=0x3f84098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84098*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.741] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.741] WriteFile (in: hFile=0x180, lpBuffer=0x3f84098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84098*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.742] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.743] WriteFile (in: hFile=0x180, lpBuffer=0x3f84098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84098*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.745] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84098 | out: hHeap=0x5e0000) returned 1 [0069.745] CloseHandle (hObject=0x180) returned 1 [0069.918] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0069.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.918] lstrlenW (lpString=".doc") returned 4 [0069.918] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.918] lstrlenW (lpString=".docx") returned 5 [0069.918] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0069.918] lstrlenW (lpString=".pdf") returned 4 [0069.919] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString=".xls") returned 4 [0069.919] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString=".xlsx") returned 5 [0069.919] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0069.919] lstrlenW (lpString=".ppt") returned 4 [0069.919] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.919] lstrlenW (lpString=".zip") returned 4 [0069.919] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString=".rar") returned 4 [0069.919] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString=".bz2") returned 4 [0069.919] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.919] lstrlenW (lpString=".7z") returned 3 [0069.919] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.919] lstrlenW (lpString=".dbf") returned 4 [0069.919] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.919] lstrlenW (lpString=".1cd") returned 4 [0069.919] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.919] lstrlenW (lpString=".jpg") returned 4 [0069.919] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.919] lstrlenW (lpString=".doc") returned 4 [0069.919] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString=".docx") returned 5 [0069.919] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0069.919] lstrlenW (lpString=".pdf") returned 4 [0069.919] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString=".xls") returned 4 [0069.919] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.919] lstrlenW (lpString=".xlsx") returned 5 [0069.919] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0069.920] lstrlenW (lpString=".ppt") returned 4 [0069.920] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.920] lstrlenW (lpString=".zip") returned 4 [0069.920] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.920] lstrlenW (lpString=".rar") returned 4 [0069.920] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.920] lstrlenW (lpString=".bz2") returned 4 [0069.920] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.920] lstrlenW (lpString=".7z") returned 3 [0069.920] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.920] lstrlenW (lpString=".dbf") returned 4 [0069.920] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.920] lstrlenW (lpString=".1cd") returned 4 [0069.920] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0069.920] lstrlenW (lpString=".jpg") returned 4 [0069.920] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.920] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0069.920] lstrlenW (lpString="VisioMUI.msi") returned 12 [0069.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.920] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=2797568) returned 1 [0069.921] CloseHandle (hObject=0x180) returned 1 [0069.921] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0069.921] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0069.921] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0069.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.921] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0069.921] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0069.921] ReadFile (in: hFile=0x180, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.375] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.375] ReadFile (in: hFile=0x180, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.455] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.455] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.455] ReadFile (in: hFile=0x180, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.591] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.592] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0070.712] SetEndOfFile (hFile=0x180) returned 1 [0070.712] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0070.716] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.716] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.717] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.717] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.720] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0070.720] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.722] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0070.722] CloseHandle (hObject=0x180) returned 1 [0070.723] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0070.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.723] lstrlenW (lpString=".doc") returned 4 [0070.723] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.723] lstrlenW (lpString=".docx") returned 5 [0070.723] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.723] lstrlenW (lpString=".pdf") returned 4 [0070.723] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.723] lstrlenW (lpString=".xls") returned 4 [0070.723] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.723] lstrlenW (lpString=".xlsx") returned 5 [0070.723] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.723] lstrlenW (lpString=".ppt") returned 4 [0070.723] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.723] lstrlenW (lpString=".zip") returned 4 [0070.723] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.723] lstrlenW (lpString=".rar") returned 4 [0070.723] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.723] lstrlenW (lpString=".bz2") returned 4 [0070.723] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.723] lstrlenW (lpString=".7z") returned 3 [0070.723] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.723] lstrlenW (lpString=".dbf") returned 4 [0070.723] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.723] lstrlenW (lpString=".1cd") returned 4 [0070.724] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.724] lstrlenW (lpString=".jpg") returned 4 [0070.724] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.724] lstrlenW (lpString=".doc") returned 4 [0070.724] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.724] lstrlenW (lpString=".docx") returned 5 [0070.724] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.724] lstrlenW (lpString=".pdf") returned 4 [0070.724] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.724] lstrlenW (lpString=".xls") returned 4 [0070.724] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.724] lstrlenW (lpString=".xlsx") returned 5 [0070.724] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.724] lstrlenW (lpString=".ppt") returned 4 [0070.724] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.724] lstrlenW (lpString=".zip") returned 4 [0070.724] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.724] lstrlenW (lpString=".rar") returned 4 [0070.724] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.724] lstrlenW (lpString=".bz2") returned 4 [0070.724] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.724] lstrlenW (lpString=".7z") returned 3 [0070.724] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.724] lstrlenW (lpString=".dbf") returned 4 [0070.724] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.724] lstrlenW (lpString=".1cd") returned 4 [0070.724] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0070.724] lstrlenW (lpString=".jpg") returned 4 [0070.724] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.725] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0070.725] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0070.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0070.725] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=2507776) returned 1 [0070.725] CloseHandle (hObject=0x180) returned 1 [0070.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0070.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0070.725] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0070.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0070.726] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0070.726] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.726] ReadFile (in: hFile=0x180, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.847] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.847] ReadFile (in: hFile=0x180, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.866] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.867] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.867] ReadFile (in: hFile=0x180, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.090] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.090] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0071.103] SetEndOfFile (hFile=0x180) returned 1 [0071.103] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0071.107] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.107] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.108] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.108] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.111] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.112] WriteFile (in: hFile=0x180, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.114] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0071.114] CloseHandle (hObject=0x180) returned 1 [0071.114] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.114] lstrlenW (lpString=".doc") returned 4 [0071.114] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.114] lstrlenW (lpString=".docx") returned 5 [0071.114] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0071.114] lstrlenW (lpString=".pdf") returned 4 [0071.114] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.114] lstrlenW (lpString=".xls") returned 4 [0071.114] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.115] lstrlenW (lpString=".xlsx") returned 5 [0071.115] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0071.115] lstrlenW (lpString=".ppt") returned 4 [0071.115] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.115] lstrlenW (lpString=".zip") returned 4 [0071.115] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.115] lstrlenW (lpString=".rar") returned 4 [0071.115] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.115] lstrlenW (lpString=".bz2") returned 4 [0071.115] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.115] lstrlenW (lpString=".7z") returned 3 [0071.115] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.115] lstrlenW (lpString=".dbf") returned 4 [0071.115] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.115] lstrlenW (lpString=".1cd") returned 4 [0071.115] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.115] lstrlenW (lpString=".jpg") returned 4 [0071.115] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.115] lstrlenW (lpString=".doc") returned 4 [0071.115] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.115] lstrlenW (lpString=".docx") returned 5 [0071.115] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0071.115] lstrlenW (lpString=".pdf") returned 4 [0071.115] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.115] lstrlenW (lpString=".xls") returned 4 [0071.115] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.115] lstrlenW (lpString=".xlsx") returned 5 [0071.115] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0071.115] lstrlenW (lpString=".ppt") returned 4 [0071.115] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.115] lstrlenW (lpString=".zip") returned 4 [0071.115] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.116] lstrlenW (lpString=".rar") returned 4 [0071.116] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.116] lstrlenW (lpString=".bz2") returned 4 [0071.116] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.116] lstrlenW (lpString=".7z") returned 3 [0071.116] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.116] lstrlenW (lpString=".dbf") returned 4 [0071.116] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.116] lstrlenW (lpString=".1cd") returned 4 [0071.116] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0071.116] lstrlenW (lpString=".jpg") returned 4 [0071.116] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.116] lstrcmpiW (lpString1=".manifest", lpString2=".beets") returned 1 [0071.116] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0071.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.201] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=1857) returned 1 [0071.201] CloseHandle (hObject=0x160) returned 1 [0071.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0071.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.202] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.202] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.202] GetLastError () returned 0x0 [0071.202] ReadFile (in: hFile=0x160, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x741, lpOverlapped=0x0) returned 1 [0071.336] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0x750, lpOverlapped=0x0) returned 1 [0071.337] ReadFile (in: hFile=0x160, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.337] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0x10a, lpOverlapped=0x0) returned 1 [0071.338] SetEndOfFile (hFile=0x180) returned 1 [0071.338] CloseHandle (hObject=0x180) returned 1 [0071.338] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.338] SetEndOfFile (hFile=0x160) returned 1 [0071.339] CloseHandle (hObject=0x160) returned 1 [0071.339] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.339] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0071.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.340] lstrlenW (lpString=".doc") returned 4 [0071.340] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString=".docx") returned 5 [0071.340] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0071.340] lstrlenW (lpString=".pdf") returned 4 [0071.340] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString=".xls") returned 4 [0071.340] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString=".xlsx") returned 5 [0071.340] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0071.340] lstrlenW (lpString=".ppt") returned 4 [0071.340] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.340] lstrlenW (lpString=".zip") returned 4 [0071.340] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString=".rar") returned 4 [0071.340] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString=".bz2") returned 4 [0071.340] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString=".7z") returned 3 [0071.340] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0071.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.340] lstrlenW (lpString=".dbf") returned 4 [0071.340] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.340] lstrlenW (lpString=".1cd") returned 4 [0071.340] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0071.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.340] lstrlenW (lpString=".jpg") returned 4 [0071.340] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.341] lstrlenW (lpString=".doc") returned 4 [0071.341] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString=".docx") returned 5 [0071.341] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0071.341] lstrlenW (lpString=".pdf") returned 4 [0071.341] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString=".xls") returned 4 [0071.341] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString=".xlsx") returned 5 [0071.341] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0071.341] lstrlenW (lpString=".ppt") returned 4 [0071.341] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.341] lstrlenW (lpString=".zip") returned 4 [0071.341] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString=".rar") returned 4 [0071.341] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString=".bz2") returned 4 [0071.341] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString=".7z") returned 3 [0071.341] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0071.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.341] lstrlenW (lpString=".dbf") returned 4 [0071.341] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.341] lstrlenW (lpString=".1cd") returned 4 [0071.341] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0071.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0071.341] lstrlenW (lpString=".jpg") returned 4 [0071.341] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0071.342] lstrcmpiW (lpString1=".msi", lpString2=".beets") returned 1 [0071.342] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0071.342] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.342] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=868864) returned 1 [0071.342] CloseHandle (hObject=0x160) returned 1 [0071.342] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0071.342] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.342] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.342] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.343] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.343] GetLastError () returned 0x0 [0071.343] ReadFile (in: hFile=0x160, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0071.597] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0071.608] ReadFile (in: hFile=0x160, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.608] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0071.608] SetEndOfFile (hFile=0x180) returned 1 [0071.608] CloseHandle (hObject=0x180) returned 1 [0071.609] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.609] SetEndOfFile (hFile=0x160) returned 1 [0071.612] CloseHandle (hObject=0x160) returned 1 [0071.612] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.613] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0071.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.613] lstrlenW (lpString=".doc") returned 4 [0071.613] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.613] lstrlenW (lpString=".docx") returned 5 [0071.613] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0071.613] lstrlenW (lpString=".pdf") returned 4 [0071.613] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.613] lstrlenW (lpString=".xls") returned 4 [0071.613] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.613] lstrlenW (lpString=".xlsx") returned 5 [0071.613] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0071.613] lstrlenW (lpString=".ppt") returned 4 [0071.613] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.613] lstrlenW (lpString=".zip") returned 4 [0071.613] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.613] lstrlenW (lpString=".rar") returned 4 [0071.613] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.613] lstrlenW (lpString=".bz2") returned 4 [0071.613] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.613] lstrlenW (lpString=".7z") returned 3 [0071.614] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.614] lstrlenW (lpString=".dbf") returned 4 [0071.614] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.614] lstrlenW (lpString=".1cd") returned 4 [0071.614] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.614] lstrlenW (lpString=".jpg") returned 4 [0071.614] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.614] lstrlenW (lpString=".doc") returned 4 [0071.614] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.614] lstrlenW (lpString=".docx") returned 5 [0071.614] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0071.614] lstrlenW (lpString=".pdf") returned 4 [0071.614] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.614] lstrlenW (lpString=".xls") returned 4 [0071.614] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.614] lstrlenW (lpString=".xlsx") returned 5 [0071.614] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0071.614] lstrlenW (lpString=".ppt") returned 4 [0071.614] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.614] lstrlenW (lpString=".zip") returned 4 [0071.614] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.614] lstrlenW (lpString=".rar") returned 4 [0071.614] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.615] lstrlenW (lpString=".bz2") returned 4 [0071.615] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.615] lstrlenW (lpString=".7z") returned 3 [0071.615] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.615] lstrlenW (lpString=".dbf") returned 4 [0071.615] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.615] lstrlenW (lpString=".1cd") returned 4 [0071.615] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0071.615] lstrlenW (lpString=".jpg") returned 4 [0071.615] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.615] lstrcmpiW (lpString1=".MST", lpString2=".beets") returned 1 [0071.615] lstrlenW (lpString="ShellUI.MST") returned 11 [0071.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.616] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=3584) returned 1 [0071.616] CloseHandle (hObject=0x160) returned 1 [0071.616] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0071.616] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.616] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.616] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.616] GetLastError () returned 0x0 [0071.616] ReadFile (in: hFile=0x160, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xe00, lpOverlapped=0x0) returned 1 [0071.834] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xe10, lpOverlapped=0x0) returned 1 [0071.834] ReadFile (in: hFile=0x160, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.834] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.834] SetEndOfFile (hFile=0x180) returned 1 [0071.834] CloseHandle (hObject=0x180) returned 1 [0071.835] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.835] SetEndOfFile (hFile=0x160) returned 1 [0071.836] CloseHandle (hObject=0x160) returned 1 [0071.836] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0071.836] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0071.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.836] lstrlenW (lpString=".doc") returned 4 [0071.836] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0071.836] lstrlenW (lpString=".docx") returned 5 [0071.836] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0071.836] lstrlenW (lpString=".pdf") returned 4 [0071.836] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0071.836] lstrlenW (lpString=".xls") returned 4 [0071.837] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0071.837] lstrlenW (lpString=".xlsx") returned 5 [0071.837] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0071.837] lstrlenW (lpString=".ppt") returned 4 [0071.837] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0071.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.837] lstrlenW (lpString=".zip") returned 4 [0071.837] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0071.837] lstrlenW (lpString=".rar") returned 4 [0071.837] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0071.837] lstrlenW (lpString=".bz2") returned 4 [0071.837] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0071.837] lstrlenW (lpString=".7z") returned 3 [0071.837] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0071.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.837] lstrlenW (lpString=".dbf") returned 4 [0071.837] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0071.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.837] lstrlenW (lpString=".1cd") returned 4 [0071.837] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0071.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.837] lstrlenW (lpString=".jpg") returned 4 [0071.837] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0071.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.837] lstrlenW (lpString=".doc") returned 4 [0071.837] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0071.837] lstrlenW (lpString=".docx") returned 5 [0071.837] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0071.838] lstrlenW (lpString=".pdf") returned 4 [0071.838] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0071.838] lstrlenW (lpString=".xls") returned 4 [0071.838] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0071.838] lstrlenW (lpString=".xlsx") returned 5 [0071.838] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0071.838] lstrlenW (lpString=".ppt") returned 4 [0071.838] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0071.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.838] lstrlenW (lpString=".zip") returned 4 [0071.838] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0071.838] lstrlenW (lpString=".rar") returned 4 [0071.838] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0071.838] lstrlenW (lpString=".bz2") returned 4 [0071.838] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0071.838] lstrlenW (lpString=".7z") returned 3 [0071.838] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0071.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.838] lstrlenW (lpString=".dbf") returned 4 [0071.838] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0071.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.838] lstrlenW (lpString=".1cd") returned 4 [0071.838] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0071.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0071.838] lstrlenW (lpString=".jpg") returned 4 [0071.838] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0071.839] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0071.839] lstrlenW (lpString="AccLR.cab") returned 9 [0071.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.839] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=28016276) returned 1 [0071.839] CloseHandle (hObject=0x160) returned 1 [0071.839] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0071.839] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0071.839] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0071.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.840] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0071.840] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.840] ReadFile (in: hFile=0x160, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.906] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.906] ReadFile (in: hFile=0x160, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.986] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.986] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.986] ReadFile (in: hFile=0x160, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.098] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.098] WriteFile (in: hFile=0x160, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0072.136] SetEndOfFile (hFile=0x160) returned 1 [0072.136] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0072.137] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.137] WriteFile (in: hFile=0x160, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.195] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.195] WriteFile (in: hFile=0x160, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.197] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0072.197] WriteFile (in: hFile=0x160, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.199] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0072.199] CloseHandle (hObject=0x160) returned 1 [0072.324] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0072.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.324] lstrlenW (lpString=".doc") returned 4 [0072.324] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0072.324] lstrlenW (lpString=".docx") returned 5 [0072.324] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0072.324] lstrlenW (lpString=".pdf") returned 4 [0072.324] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0072.324] lstrlenW (lpString=".xls") returned 4 [0072.324] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0072.324] lstrlenW (lpString=".xlsx") returned 5 [0072.324] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0072.324] lstrlenW (lpString=".ppt") returned 4 [0072.325] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0072.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.325] lstrlenW (lpString=".zip") returned 4 [0072.325] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0072.325] lstrlenW (lpString=".rar") returned 4 [0072.325] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0072.325] lstrlenW (lpString=".bz2") returned 4 [0072.325] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0072.325] lstrlenW (lpString=".7z") returned 3 [0072.325] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0072.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.325] lstrlenW (lpString=".dbf") returned 4 [0072.325] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0072.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.325] lstrlenW (lpString=".1cd") returned 4 [0072.325] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0072.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.325] lstrlenW (lpString=".jpg") returned 4 [0072.325] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0072.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.325] lstrlenW (lpString=".doc") returned 4 [0072.325] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0072.325] lstrlenW (lpString=".docx") returned 5 [0072.325] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0072.325] lstrlenW (lpString=".pdf") returned 4 [0072.325] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0072.325] lstrlenW (lpString=".xls") returned 4 [0072.325] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0072.326] lstrlenW (lpString=".xlsx") returned 5 [0072.326] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0072.326] lstrlenW (lpString=".ppt") returned 4 [0072.326] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0072.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.326] lstrlenW (lpString=".zip") returned 4 [0072.326] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0072.326] lstrlenW (lpString=".rar") returned 4 [0072.326] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0072.326] lstrlenW (lpString=".bz2") returned 4 [0072.326] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0072.326] lstrlenW (lpString=".7z") returned 3 [0072.326] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0072.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.326] lstrlenW (lpString=".dbf") returned 4 [0072.326] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0072.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.326] lstrlenW (lpString=".1cd") returned 4 [0072.326] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0072.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0072.326] lstrlenW (lpString=".jpg") returned 4 [0072.326] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0072.326] lstrcmpiW (lpString1=".dll", lpString2=".beets") returned 1 [0072.326] lstrlenW (lpString="PidGenX.dll") returned 11 [0072.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0072.327] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=1463568) returned 1 [0072.327] CloseHandle (hObject=0x218) returned 1 [0072.327] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0072.327] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0072.327] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.327] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0072.328] GetLastError () returned 0x0 [0072.328] ReadFile (in: hFile=0x218, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0072.619] WriteFile (in: hFile=0x178, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0072.698] ReadFile (in: hFile=0x218, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x65520, lpOverlapped=0x0) returned 1 [0072.819] WriteFile (in: hFile=0x178, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0072.827] ReadFile (in: hFile=0x218, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0072.827] WriteFile (in: hFile=0x178, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.828] SetEndOfFile (hFile=0x178) returned 1 [0072.828] CloseHandle (hObject=0x178) returned 1 [0072.828] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.828] SetEndOfFile (hFile=0x218) returned 1 [0072.830] CloseHandle (hObject=0x218) returned 1 [0072.830] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0072.830] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0072.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.830] lstrlenW (lpString=".doc") returned 4 [0072.830] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.831] lstrlenW (lpString=".docx") returned 5 [0072.831] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0072.831] lstrlenW (lpString=".pdf") returned 4 [0072.831] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.831] lstrlenW (lpString=".xls") returned 4 [0072.831] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.831] lstrlenW (lpString=".xlsx") returned 5 [0072.831] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0072.831] lstrlenW (lpString=".ppt") returned 4 [0072.831] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.831] lstrlenW (lpString=".zip") returned 4 [0072.831] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.831] lstrlenW (lpString=".rar") returned 4 [0072.831] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.831] lstrlenW (lpString=".bz2") returned 4 [0072.831] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.831] lstrlenW (lpString=".7z") returned 3 [0072.831] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.831] lstrlenW (lpString=".dbf") returned 4 [0072.831] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.831] lstrlenW (lpString=".1cd") returned 4 [0072.831] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.831] lstrlenW (lpString=".jpg") returned 4 [0072.831] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.831] lstrlenW (lpString=".doc") returned 4 [0072.831] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.832] lstrlenW (lpString=".docx") returned 5 [0072.832] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0072.832] lstrlenW (lpString=".pdf") returned 4 [0072.832] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.832] lstrlenW (lpString=".xls") returned 4 [0072.832] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.832] lstrlenW (lpString=".xlsx") returned 5 [0072.832] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0072.832] lstrlenW (lpString=".ppt") returned 4 [0072.832] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.832] lstrlenW (lpString=".zip") returned 4 [0072.832] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.832] lstrlenW (lpString=".rar") returned 4 [0072.832] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.832] lstrlenW (lpString=".bz2") returned 4 [0072.832] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.832] lstrlenW (lpString=".7z") returned 3 [0072.832] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.832] lstrlenW (lpString=".dbf") returned 4 [0072.832] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.832] lstrlenW (lpString=".1cd") returned 4 [0072.832] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0072.832] lstrlenW (lpString=".jpg") returned 4 [0072.832] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.832] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0072.832] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0072.832] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0072.833] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=222948913) returned 1 [0072.833] CloseHandle (hObject=0x218) returned 1 [0072.833] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0072.833] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0072.833] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0072.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0072.833] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0072.833] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0072.834] ReadFile (in: hFile=0x218, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.292] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.292] ReadFile (in: hFile=0x218, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.575] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.575] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.575] ReadFile (in: hFile=0x218, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.656] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.656] WriteFile (in: hFile=0x218, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0073.665] SetEndOfFile (hFile=0x218) returned 1 [0073.665] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40000) returned 0x3f84090 [0073.669] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0073.669] WriteFile (in: hFile=0x218, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.669] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0073.669] WriteFile (in: hFile=0x218, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.671] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0073.671] WriteFile (in: hFile=0x218, lpBuffer=0x3f84090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84090*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.672] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3f84090 | out: hHeap=0x5e0000) returned 1 [0073.672] CloseHandle (hObject=0x218) returned 1 [0073.672] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0073.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.672] lstrlenW (lpString=".doc") returned 4 [0073.672] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.672] lstrlenW (lpString=".docx") returned 5 [0073.672] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0073.672] lstrlenW (lpString=".pdf") returned 4 [0073.672] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.672] lstrlenW (lpString=".xls") returned 4 [0073.672] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.672] lstrlenW (lpString=".xlsx") returned 5 [0073.672] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0073.672] lstrlenW (lpString=".ppt") returned 4 [0073.672] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.672] lstrlenW (lpString=".zip") returned 4 [0073.673] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString=".rar") returned 4 [0073.673] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString=".bz2") returned 4 [0073.673] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.673] lstrlenW (lpString=".7z") returned 3 [0073.673] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.673] lstrlenW (lpString=".dbf") returned 4 [0073.673] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.673] lstrlenW (lpString=".1cd") returned 4 [0073.673] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.673] lstrlenW (lpString=".jpg") returned 4 [0073.673] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.673] lstrlenW (lpString=".doc") returned 4 [0073.673] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString=".docx") returned 5 [0073.673] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0073.673] lstrlenW (lpString=".pdf") returned 4 [0073.673] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString=".xls") returned 4 [0073.673] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString=".xlsx") returned 5 [0073.673] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0073.673] lstrlenW (lpString=".ppt") returned 4 [0073.673] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.673] lstrlenW (lpString=".zip") returned 4 [0073.673] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString=".rar") returned 4 [0073.673] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.673] lstrlenW (lpString=".bz2") returned 4 [0073.673] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.674] lstrlenW (lpString=".7z") returned 3 [0073.674] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.674] lstrlenW (lpString=".dbf") returned 4 [0073.674] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.674] lstrlenW (lpString=".1cd") returned 4 [0073.674] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0073.674] lstrlenW (lpString=".jpg") returned 4 [0073.674] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.674] lstrcmpiW (lpString1=".exe", lpString2=".beets") returned 1 [0073.674] lstrlenW (lpString="ose.exe") returned 7 [0073.674] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0073.674] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=174440) returned 1 [0073.674] CloseHandle (hObject=0x218) returned 1 [0073.674] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0073.674] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.675] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0073.675] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.675] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.675] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0073.675] GetLastError () returned 0x0 [0073.675] ReadFile (in: hFile=0x218, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0073.790] WriteFile (in: hFile=0x184, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0073.794] ReadFile (in: hFile=0x218, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0073.794] WriteFile (in: hFile=0x184, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0073.794] SetEndOfFile (hFile=0x184) returned 1 [0073.794] CloseHandle (hObject=0x184) returned 1 [0073.794] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.794] SetEndOfFile (hFile=0x218) returned 1 [0073.795] CloseHandle (hObject=0x218) returned 1 [0073.796] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[vombombom@cock.li].beets", dwFileAttributes=0x2020) returned 1 [0073.796] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0073.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.796] lstrlenW (lpString=".doc") returned 4 [0073.796] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.796] lstrlenW (lpString=".docx") returned 5 [0073.796] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0073.796] lstrlenW (lpString=".pdf") returned 4 [0073.796] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.796] lstrlenW (lpString=".xls") returned 4 [0073.796] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.796] lstrlenW (lpString=".xlsx") returned 5 [0073.797] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0073.797] lstrlenW (lpString=".ppt") returned 4 [0073.797] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.797] lstrlenW (lpString=".zip") returned 4 [0073.797] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.797] lstrlenW (lpString=".rar") returned 4 [0073.797] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.797] lstrlenW (lpString=".bz2") returned 4 [0073.797] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.797] lstrlenW (lpString=".7z") returned 3 [0073.797] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.797] lstrlenW (lpString=".dbf") returned 4 [0073.797] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.797] lstrlenW (lpString=".1cd") returned 4 [0073.797] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.797] lstrlenW (lpString=".jpg") returned 4 [0073.797] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.797] lstrlenW (lpString=".doc") returned 4 [0073.797] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.797] lstrlenW (lpString=".docx") returned 5 [0073.797] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0073.797] lstrlenW (lpString=".pdf") returned 4 [0073.797] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.798] lstrlenW (lpString=".xls") returned 4 [0073.798] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.798] lstrlenW (lpString=".xlsx") returned 5 [0073.798] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0073.798] lstrlenW (lpString=".ppt") returned 4 [0073.798] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.798] lstrlenW (lpString=".zip") returned 4 [0073.798] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.798] lstrlenW (lpString=".rar") returned 4 [0073.798] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.798] lstrlenW (lpString=".bz2") returned 4 [0073.798] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.798] lstrlenW (lpString=".7z") returned 3 [0073.798] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.798] lstrlenW (lpString=".dbf") returned 4 [0073.798] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.798] lstrlenW (lpString=".1cd") returned 4 [0073.798] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0073.798] lstrlenW (lpString=".jpg") returned 4 [0073.798] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.799] lstrcmpiW (lpString1=".cab", lpString2=".beets") returned 1 [0073.799] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0073.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0073.800] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=36233052) returned 1 [0073.800] CloseHandle (hObject=0x218) returned 1 [0073.800] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0073.800] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 0xffffffff [0073.800] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[vombombom@cock.li].beets")) returned 1 [0073.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[vombombom@cock.li].beets" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[vombombom@cock.li].beets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0073.801] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0073.801] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.801] ReadFile (in: hFile=0x218, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.122] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0074.122] ReadFile (hFile=0x218, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0) Thread: id = 18 os_tid = 0xa7c [0051.648] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39006c0 [0051.649] lstrlenW (lpString="C:") returned 2 [0051.649] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33ffd00 | out: lpFindFileData=0x33ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x631020 [0051.650] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0051.650] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0051.650] lstrlenW (lpString="$Recycle.Bin") returned 12 [0051.650] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0051.650] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39106c8 [0051.650] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0051.650] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fce8 [0051.651] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.651] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0051.651] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0051.651] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0051.651] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0051.651] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0051.651] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.651] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0051.651] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fd28 [0051.652] FindNextFileW (in: hFindFile=0x65fd28, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.652] FindNextFileW (in: hFindFile=0x65fd28, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.652] lstrlenW (lpString="desktop.ini") returned 11 [0051.652] lstrlenW (lpString=".1cd") returned 4 [0051.652] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.652] lstrlenW (lpString=".3ds") returned 4 [0051.652] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0051.652] lstrlenW (lpString=".3fr") returned 4 [0051.652] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0051.652] lstrlenW (lpString=".3g2") returned 4 [0051.652] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0051.652] lstrlenW (lpString=".3gp") returned 4 [0051.652] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0051.652] lstrlenW (lpString=".7z") returned 3 [0051.652] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.652] lstrlenW (lpString=".accda") returned 6 [0051.653] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0051.653] lstrlenW (lpString=".accdb") returned 6 [0051.653] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0051.653] lstrlenW (lpString=".accdc") returned 6 [0051.653] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0051.653] lstrlenW (lpString=".accde") returned 6 [0051.653] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0051.653] lstrlenW (lpString=".accdt") returned 6 [0051.653] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0051.653] lstrlenW (lpString=".accdw") returned 6 [0051.653] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0051.653] lstrlenW (lpString=".adb") returned 4 [0051.653] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0051.653] lstrlenW (lpString=".adp") returned 4 [0051.653] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0051.653] lstrlenW (lpString=".ai") returned 3 [0051.653] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0051.653] lstrlenW (lpString=".ai3") returned 4 [0051.653] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0051.653] lstrlenW (lpString=".ai4") returned 4 [0051.653] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0051.653] lstrlenW (lpString=".ai5") returned 4 [0051.653] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0051.653] lstrlenW (lpString=".ai6") returned 4 [0051.653] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0051.653] lstrlenW (lpString=".ai7") returned 4 [0051.653] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".ai8") returned 4 [0051.654] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".anim") returned 5 [0051.654] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0051.654] lstrlenW (lpString=".arw") returned 4 [0051.654] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".as") returned 3 [0051.654] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0051.654] lstrlenW (lpString=".asa") returned 4 [0051.654] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".asc") returned 4 [0051.654] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".ascx") returned 5 [0051.654] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0051.654] lstrlenW (lpString=".asm") returned 4 [0051.654] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".asmx") returned 5 [0051.654] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0051.654] lstrlenW (lpString=".asp") returned 4 [0051.654] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".aspx") returned 5 [0051.654] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0051.654] lstrlenW (lpString=".asr") returned 4 [0051.654] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".asx") returned 4 [0051.654] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0051.654] lstrlenW (lpString=".avi") returned 4 [0051.655] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".avs") returned 4 [0051.655] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".backup") returned 7 [0051.655] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0051.655] lstrlenW (lpString=".bak") returned 4 [0051.655] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".bay") returned 4 [0051.655] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".bd") returned 3 [0051.655] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0051.655] lstrlenW (lpString=".bin") returned 4 [0051.655] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".bmp") returned 4 [0051.655] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".bz2") returned 4 [0051.655] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".c") returned 2 [0051.655] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0051.655] lstrlenW (lpString=".cdr") returned 4 [0051.655] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".cer") returned 4 [0051.655] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0051.655] lstrlenW (lpString=".cf") returned 3 [0051.655] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0051.655] lstrlenW (lpString=".cfc") returned 4 [0051.656] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0051.656] lstrlenW (lpString=".cfm") returned 4 [0051.656] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0051.656] lstrlenW (lpString=".cfml") returned 5 [0051.656] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0051.656] lstrlenW (lpString=".cfu") returned 4 [0051.656] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0051.656] lstrlenW (lpString=".chm") returned 4 [0051.656] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0051.656] lstrlenW (lpString=".cin") returned 4 [0051.656] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0051.656] lstrlenW (lpString=".class") returned 6 [0051.656] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0051.656] lstrlenW (lpString=".clx") returned 4 [0051.656] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0051.656] lstrlenW (lpString=".config") returned 7 [0051.656] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0051.656] lstrlenW (lpString=".cpp") returned 4 [0051.656] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0051.656] lstrlenW (lpString=".cr2") returned 4 [0051.657] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0051.657] lstrlenW (lpString=".crt") returned 4 [0051.657] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0051.657] lstrlenW (lpString=".crw") returned 4 [0051.657] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0051.657] lstrlenW (lpString=".cs") returned 3 [0051.657] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0051.657] lstrlenW (lpString=".css") returned 4 [0051.657] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0051.657] lstrlenW (lpString=".csv") returned 4 [0051.657] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0051.657] lstrlenW (lpString=".cub") returned 4 [0051.657] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0051.657] lstrlenW (lpString=".dae") returned 4 [0051.657] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0051.657] lstrlenW (lpString=".dat") returned 4 [0051.657] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0051.657] lstrlenW (lpString=".db") returned 3 [0051.657] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0051.657] lstrlenW (lpString=".dbf") returned 4 [0051.658] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".dbx") returned 4 [0051.658] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".dc3") returned 4 [0051.658] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".dcm") returned 4 [0051.658] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".dcr") returned 4 [0051.658] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".der") returned 4 [0051.658] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".dib") returned 4 [0051.658] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".dic") returned 4 [0051.658] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".dif") returned 4 [0051.658] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0051.658] lstrlenW (lpString=".divx") returned 5 [0051.658] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0051.658] lstrlenW (lpString=".djvu") returned 5 [0051.659] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0051.659] lstrlenW (lpString=".dng") returned 4 [0051.659] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0051.659] lstrlenW (lpString=".doc") returned 4 [0051.659] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.659] lstrlenW (lpString=".docm") returned 5 [0051.659] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0051.659] lstrlenW (lpString=".docx") returned 5 [0051.659] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0051.659] lstrlenW (lpString=".dot") returned 4 [0051.659] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0051.659] lstrlenW (lpString=".dotm") returned 5 [0051.659] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0051.659] lstrlenW (lpString=".dotx") returned 5 [0051.659] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0051.659] lstrlenW (lpString=".dpx") returned 4 [0051.659] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0051.659] lstrlenW (lpString=".dqy") returned 4 [0051.659] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0051.659] lstrlenW (lpString=".dsn") returned 4 [0051.659] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0051.659] lstrlenW (lpString=".dt") returned 3 [0051.660] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0051.660] lstrlenW (lpString=".dtd") returned 4 [0051.660] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0051.660] lstrlenW (lpString=".dwg") returned 4 [0051.660] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0051.660] lstrlenW (lpString=".dwt") returned 4 [0051.660] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0051.660] lstrlenW (lpString=".dx") returned 3 [0051.660] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0051.660] lstrlenW (lpString=".dxf") returned 4 [0051.660] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0051.660] lstrlenW (lpString=".edml") returned 5 [0051.660] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0051.660] lstrlenW (lpString=".efd") returned 4 [0051.660] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0051.660] lstrlenW (lpString=".elf") returned 4 [0051.660] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0051.660] lstrlenW (lpString=".emf") returned 4 [0051.660] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0051.660] lstrlenW (lpString=".emz") returned 4 [0051.660] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".epf") returned 4 [0051.661] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".eps") returned 4 [0051.661] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".epsf") returned 5 [0051.661] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0051.661] lstrlenW (lpString=".epsp") returned 5 [0051.661] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0051.661] lstrlenW (lpString=".erf") returned 4 [0051.661] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".exr") returned 4 [0051.661] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".f4v") returned 4 [0051.661] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".fido") returned 5 [0051.661] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0051.661] lstrlenW (lpString=".flm") returned 4 [0051.661] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".flv") returned 4 [0051.661] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".frm") returned 4 [0051.661] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".fxg") returned 4 [0051.661] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".geo") returned 4 [0051.661] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0051.661] lstrlenW (lpString=".gif") returned 4 [0051.661] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".grs") returned 4 [0051.662] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".gz") returned 3 [0051.662] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0051.662] lstrlenW (lpString=".h") returned 2 [0051.662] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0051.662] lstrlenW (lpString=".hdr") returned 4 [0051.662] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".hpp") returned 4 [0051.662] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".hta") returned 4 [0051.662] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".htc") returned 4 [0051.662] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".htm") returned 4 [0051.662] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".html") returned 5 [0051.662] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0051.662] lstrlenW (lpString=".icb") returned 4 [0051.662] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".ics") returned 4 [0051.662] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".iff") returned 4 [0051.662] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".inc") returned 4 [0051.662] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0051.662] lstrlenW (lpString=".indd") returned 5 [0051.662] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0051.663] lstrlenW (lpString=".ini") returned 4 [0051.663] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0051.663] lstrlenW (lpString="desktop.ini") returned 11 [0051.663] lstrlenW (lpString=".beets") returned 6 [0051.663] lstrcmpiW (lpString1=".beets", lpString2="op.ini") returned -1 [0051.663] lstrlenW (lpString="desktop.ini") returned 11 [0051.663] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0051.663] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0051.663] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0051.663] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0051.663] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0051.663] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0051.663] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0051.663] lstrcmpiW (lpString1="svhost.exe", lpString2="desktop.ini") returned 1 [0051.663] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0051.663] FindNextFileW (in: hFindFile=0x65fd28, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0051.663] FindClose (in: hFindFile=0x65fd28 | out: hFindFile=0x65fd28) returned 1 [0051.664] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.664] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0051.664] FindClose (in: hFindFile=0x65fce8 | out: hFindFile=0x65fce8) returned 1 [0051.664] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39106c8 | out: hHeap=0x5e0000) returned 1 [0051.664] FindNextFileW (in: hFindFile=0x631020, lpFindFileData=0x33ffd00 | out: lpFindFileData=0x33ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0051.664] lstrlenW (lpString="C:\\Boot") returned 7 [0051.664] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0051.664] lstrlenW (lpString="Boot") returned 4 [0051.664] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0051.664] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39106c8 [0051.664] lstrlenW (lpString="C:\\Boot") returned 7 [0051.664] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fce8 [0051.664] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.664] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0051.665] lstrlenW (lpString="BCD") returned 3 [0051.665] lstrlenW (lpString=".1cd") returned 4 [0051.665] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".3ds") returned 4 [0051.665] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".3fr") returned 4 [0051.665] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".3g2") returned 4 [0051.665] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".3gp") returned 4 [0051.665] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".7z") returned 3 [0051.665] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0051.665] lstrlenW (lpString=".accda") returned 6 [0051.665] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".accdb") returned 6 [0051.665] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".accdc") returned 6 [0051.665] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".accde") returned 6 [0051.665] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".accdt") returned 6 [0051.665] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".accdw") returned 6 [0051.665] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0051.665] lstrlenW (lpString=".adb") returned 4 [0051.666] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".adp") returned 4 [0051.666] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".ai") returned 3 [0051.666] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0051.666] lstrlenW (lpString=".ai3") returned 4 [0051.666] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".ai4") returned 4 [0051.666] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".ai5") returned 4 [0051.666] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".ai6") returned 4 [0051.666] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".ai7") returned 4 [0051.666] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".ai8") returned 4 [0051.666] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".anim") returned 5 [0051.666] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".arw") returned 4 [0051.666] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".as") returned 3 [0051.666] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0051.666] lstrlenW (lpString=".asa") returned 4 [0051.666] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".asc") returned 4 [0051.666] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".ascx") returned 5 [0051.666] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0051.666] lstrlenW (lpString=".asm") returned 4 [0051.667] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".asmx") returned 5 [0051.667] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".asp") returned 4 [0051.667] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".aspx") returned 5 [0051.667] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".asr") returned 4 [0051.667] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".asx") returned 4 [0051.667] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".avi") returned 4 [0051.667] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".avs") returned 4 [0051.667] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".backup") returned 7 [0051.667] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".bak") returned 4 [0051.667] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".bay") returned 4 [0051.667] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".bd") returned 3 [0051.667] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0051.667] lstrlenW (lpString=".bin") returned 4 [0051.667] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".bmp") returned 4 [0051.667] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0051.667] lstrlenW (lpString=".bz2") returned 4 [0051.667] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".c") returned 2 [0051.668] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0051.668] lstrlenW (lpString=".cdr") returned 4 [0051.668] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".cer") returned 4 [0051.668] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".cf") returned 3 [0051.668] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0051.668] lstrlenW (lpString=".cfc") returned 4 [0051.668] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".cfm") returned 4 [0051.668] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".cfml") returned 5 [0051.668] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".cfu") returned 4 [0051.668] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".chm") returned 4 [0051.668] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".cin") returned 4 [0051.668] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".class") returned 6 [0051.668] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".clx") returned 4 [0051.668] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".config") returned 7 [0051.668] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".cpp") returned 4 [0051.668] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0051.668] lstrlenW (lpString=".cr2") returned 4 [0051.668] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".crt") returned 4 [0051.669] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".crw") returned 4 [0051.669] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".cs") returned 3 [0051.669] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0051.669] lstrlenW (lpString=".css") returned 4 [0051.669] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".csv") returned 4 [0051.669] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".cub") returned 4 [0051.669] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".dae") returned 4 [0051.669] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".dat") returned 4 [0051.669] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".db") returned 3 [0051.669] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0051.669] lstrlenW (lpString=".dbf") returned 4 [0051.669] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".dbx") returned 4 [0051.669] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".dc3") returned 4 [0051.669] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".dcm") returned 4 [0051.669] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".dcr") returned 4 [0051.669] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0051.669] lstrlenW (lpString=".der") returned 4 [0051.669] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dib") returned 4 [0051.670] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dic") returned 4 [0051.670] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dif") returned 4 [0051.670] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".divx") returned 5 [0051.670] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".djvu") returned 5 [0051.670] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dng") returned 4 [0051.670] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".doc") returned 4 [0051.670] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".docm") returned 5 [0051.670] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".docx") returned 5 [0051.670] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dot") returned 4 [0051.670] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dotm") returned 5 [0051.670] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dotx") returned 5 [0051.670] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dpx") returned 4 [0051.670] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dqy") returned 4 [0051.670] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dsn") returned 4 [0051.670] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0051.670] lstrlenW (lpString=".dt") returned 3 [0051.671] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0051.671] lstrlenW (lpString=".dtd") returned 4 [0051.671] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".dwg") returned 4 [0051.671] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".dwt") returned 4 [0051.671] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".dx") returned 3 [0051.671] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0051.671] lstrlenW (lpString=".dxf") returned 4 [0051.671] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".edml") returned 5 [0051.671] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".efd") returned 4 [0051.671] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".elf") returned 4 [0051.671] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".emf") returned 4 [0051.671] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".emz") returned 4 [0051.671] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".epf") returned 4 [0051.671] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".eps") returned 4 [0051.671] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".epsf") returned 5 [0051.671] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".epsp") returned 5 [0051.671] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0051.671] lstrlenW (lpString=".erf") returned 4 [0051.672] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0051.672] lstrlenW (lpString=".exr") returned 4 [0051.672] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0051.672] lstrlenW (lpString=".f4v") returned 4 [0051.672] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0051.672] lstrlenW (lpString=".fido") returned 5 [0051.672] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0051.672] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.672] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.698] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.698] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.698] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.698] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.698] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0051.711] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.711] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.711] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.711] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.717] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.717] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.717] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0051.717] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.717] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.717] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.717] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.717] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.718] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.718] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0051.718] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.718] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.718] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.718] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.718] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.718] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.718] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.718] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.718] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.718] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.718] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.719] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.719] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.719] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0051.719] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.719] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.719] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.719] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.719] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.719] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.719] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0051.719] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.719] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.719] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.720] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.720] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.720] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.720] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0051.720] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.720] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.720] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.720] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0051.720] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.720] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.720] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0051.721] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.721] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.721] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.721] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.721] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.721] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.721] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0051.721] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.721] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.721] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.721] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.722] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.722] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.722] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0051.722] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.722] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.722] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.722] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.722] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.722] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.722] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0051.722] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.722] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.722] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.723] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.723] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.723] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.723] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0051.723] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.723] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.723] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.723] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.723] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.723] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.723] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0051.723] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.724] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.724] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.724] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.724] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.724] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.724] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0051.724] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.724] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.724] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.724] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.724] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.724] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.724] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0051.725] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.725] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.725] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.725] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.725] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.725] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.725] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0051.725] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.725] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.725] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.725] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.725] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.725] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.725] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0051.726] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.726] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.726] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.726] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.726] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.726] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.726] FindNextFileW (in: hFindFile=0x65fce8, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0051.726] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.726] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0052.201] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.201] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.531] FindNextFileW (in: hFindFile=0x3f33098, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.531] FindNextFileW (in: hFindFile=0x3f33098, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0052.532] lstrlenW (lpString="OutlkLR.cab") returned 11 [0052.532] lstrlenW (lpString=".1cd") returned 4 [0052.532] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.532] lstrlenW (lpString=".3ds") returned 4 [0052.532] lstrcmpiW (lpString1=".3ds", lpString2=".cab") returned -1 [0052.532] lstrlenW (lpString=".3fr") returned 4 [0052.532] lstrcmpiW (lpString1=".3fr", lpString2=".cab") returned -1 [0052.532] lstrlenW (lpString=".3g2") returned 4 [0052.532] lstrcmpiW (lpString1=".3g2", lpString2=".cab") returned -1 [0052.532] lstrlenW (lpString=".3gp") returned 4 [0052.532] lstrcmpiW (lpString1=".3gp", lpString2=".cab") returned -1 [0052.532] lstrlenW (lpString=".7z") returned 3 [0052.532] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.532] lstrlenW (lpString=".accda") returned 6 [0052.532] lstrcmpiW (lpString1=".accda", lpString2="LR.cab") returned -1 [0052.532] lstrlenW (lpString=".accdb") returned 6 [0052.532] lstrcmpiW (lpString1=".accdb", lpString2="LR.cab") returned -1 [0052.532] lstrlenW (lpString=".accdc") returned 6 [0052.532] lstrcmpiW (lpString1=".accdc", lpString2="LR.cab") returned -1 [0052.533] lstrlenW (lpString=".accde") returned 6 [0052.533] lstrcmpiW (lpString1=".accde", lpString2="LR.cab") returned -1 [0052.533] lstrlenW (lpString=".accdt") returned 6 [0052.533] lstrcmpiW (lpString1=".accdt", lpString2="LR.cab") returned -1 [0052.533] lstrlenW (lpString=".accdw") returned 6 [0052.533] lstrcmpiW (lpString1=".accdw", lpString2="LR.cab") returned -1 [0052.533] lstrlenW (lpString=".adb") returned 4 [0052.533] lstrcmpiW (lpString1=".adb", lpString2=".cab") returned -1 [0052.533] lstrlenW (lpString=".adp") returned 4 [0052.533] lstrcmpiW (lpString1=".adp", lpString2=".cab") returned -1 [0052.533] lstrlenW (lpString=".ai") returned 3 [0052.533] lstrcmpiW (lpString1=".ai", lpString2="cab") returned -1 [0052.533] lstrlenW (lpString=".ai3") returned 4 [0052.533] lstrcmpiW (lpString1=".ai3", lpString2=".cab") returned -1 [0052.533] lstrlenW (lpString=".ai4") returned 4 [0052.533] lstrcmpiW (lpString1=".ai4", lpString2=".cab") returned -1 [0052.533] lstrlenW (lpString=".ai5") returned 4 [0052.533] lstrcmpiW (lpString1=".ai5", lpString2=".cab") returned -1 [0052.533] lstrlenW (lpString=".ai6") returned 4 [0052.533] lstrcmpiW (lpString1=".ai6", lpString2=".cab") returned -1 [0052.534] lstrlenW (lpString=".ai7") returned 4 [0052.534] lstrcmpiW (lpString1=".ai7", lpString2=".cab") returned -1 [0052.534] lstrlenW (lpString=".ai8") returned 4 [0052.534] lstrcmpiW (lpString1=".ai8", lpString2=".cab") returned -1 [0052.534] lstrlenW (lpString=".anim") returned 5 [0052.534] lstrcmpiW (lpString1=".anim", lpString2="R.cab") returned -1 [0052.534] lstrlenW (lpString=".arw") returned 4 [0052.534] lstrcmpiW (lpString1=".arw", lpString2=".cab") returned -1 [0052.534] lstrlenW (lpString=".as") returned 3 [0052.534] lstrcmpiW (lpString1=".as", lpString2="cab") returned -1 [0052.534] lstrlenW (lpString=".asa") returned 4 [0052.534] lstrcmpiW (lpString1=".asa", lpString2=".cab") returned -1 [0052.534] lstrlenW (lpString=".asc") returned 4 [0052.534] lstrcmpiW (lpString1=".asc", lpString2=".cab") returned -1 [0052.534] lstrlenW (lpString=".ascx") returned 5 [0052.534] lstrcmpiW (lpString1=".ascx", lpString2="R.cab") returned -1 [0052.534] lstrlenW (lpString=".asm") returned 4 [0052.534] lstrcmpiW (lpString1=".asm", lpString2=".cab") returned -1 [0052.534] lstrlenW (lpString=".asmx") returned 5 [0052.534] lstrcmpiW (lpString1=".asmx", lpString2="R.cab") returned -1 [0052.535] lstrlenW (lpString=".asp") returned 4 [0052.535] lstrcmpiW (lpString1=".asp", lpString2=".cab") returned -1 [0052.535] lstrlenW (lpString=".aspx") returned 5 [0052.535] lstrcmpiW (lpString1=".aspx", lpString2="R.cab") returned -1 [0052.535] lstrlenW (lpString=".asr") returned 4 [0052.535] lstrcmpiW (lpString1=".asr", lpString2=".cab") returned -1 [0052.535] lstrlenW (lpString=".asx") returned 4 [0052.535] lstrcmpiW (lpString1=".asx", lpString2=".cab") returned -1 [0052.535] lstrlenW (lpString=".avi") returned 4 [0052.535] lstrcmpiW (lpString1=".avi", lpString2=".cab") returned -1 [0052.535] lstrlenW (lpString=".avs") returned 4 [0052.535] lstrcmpiW (lpString1=".avs", lpString2=".cab") returned -1 [0052.535] lstrlenW (lpString=".backup") returned 7 [0052.535] lstrcmpiW (lpString1=".backup", lpString2="kLR.cab") returned -1 [0052.535] lstrlenW (lpString=".bak") returned 4 [0052.535] lstrcmpiW (lpString1=".bak", lpString2=".cab") returned -1 [0052.535] lstrlenW (lpString=".bay") returned 4 [0052.535] lstrcmpiW (lpString1=".bay", lpString2=".cab") returned -1 [0052.535] lstrlenW (lpString=".bd") returned 3 [0052.535] lstrcmpiW (lpString1=".bd", lpString2="cab") returned -1 [0052.536] lstrlenW (lpString=".bin") returned 4 [0052.536] lstrcmpiW (lpString1=".bin", lpString2=".cab") returned -1 [0052.536] lstrlenW (lpString=".bmp") returned 4 [0052.536] lstrcmpiW (lpString1=".bmp", lpString2=".cab") returned -1 [0052.536] lstrlenW (lpString=".bz2") returned 4 [0052.536] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.536] lstrlenW (lpString=".c") returned 2 [0052.536] lstrcmpiW (lpString1=".c", lpString2="ab") returned -1 [0052.536] lstrlenW (lpString=".cdr") returned 4 [0052.536] lstrcmpiW (lpString1=".cdr", lpString2=".cab") returned 1 [0052.536] lstrlenW (lpString=".cer") returned 4 [0052.536] lstrcmpiW (lpString1=".cer", lpString2=".cab") returned 1 [0052.536] lstrlenW (lpString=".cf") returned 3 [0052.536] lstrcmpiW (lpString1=".cf", lpString2="cab") returned -1 [0052.536] lstrlenW (lpString=".cfc") returned 4 [0052.536] lstrcmpiW (lpString1=".cfc", lpString2=".cab") returned 1 [0052.536] lstrlenW (lpString=".cfm") returned 4 [0052.536] lstrcmpiW (lpString1=".cfm", lpString2=".cab") returned 1 [0052.536] lstrlenW (lpString=".cfml") returned 5 [0052.536] lstrcmpiW (lpString1=".cfml", lpString2="R.cab") returned -1 [0052.537] lstrlenW (lpString=".cfu") returned 4 [0052.537] lstrcmpiW (lpString1=".cfu", lpString2=".cab") returned 1 [0052.537] lstrlenW (lpString=".chm") returned 4 [0052.537] lstrcmpiW (lpString1=".chm", lpString2=".cab") returned 1 [0052.537] lstrlenW (lpString=".cin") returned 4 [0052.537] lstrcmpiW (lpString1=".cin", lpString2=".cab") returned 1 [0052.537] lstrlenW (lpString=".class") returned 6 [0052.537] lstrcmpiW (lpString1=".class", lpString2="LR.cab") returned -1 [0052.537] lstrlenW (lpString=".clx") returned 4 [0052.537] lstrcmpiW (lpString1=".clx", lpString2=".cab") returned 1 [0052.537] lstrlenW (lpString=".config") returned 7 [0052.537] lstrcmpiW (lpString1=".config", lpString2="kLR.cab") returned -1 [0052.537] lstrlenW (lpString=".cpp") returned 4 [0052.537] lstrcmpiW (lpString1=".cpp", lpString2=".cab") returned 1 [0052.537] lstrlenW (lpString=".cr2") returned 4 [0052.537] lstrcmpiW (lpString1=".cr2", lpString2=".cab") returned 1 [0052.537] lstrlenW (lpString=".crt") returned 4 [0052.537] lstrcmpiW (lpString1=".crt", lpString2=".cab") returned 1 [0052.537] lstrlenW (lpString=".crw") returned 4 [0052.537] lstrcmpiW (lpString1=".crw", lpString2=".cab") returned 1 [0052.538] lstrlenW (lpString=".cs") returned 3 [0052.538] lstrcmpiW (lpString1=".cs", lpString2="cab") returned -1 [0052.538] lstrlenW (lpString=".css") returned 4 [0052.538] lstrcmpiW (lpString1=".css", lpString2=".cab") returned 1 [0052.538] lstrlenW (lpString=".csv") returned 4 [0052.538] lstrcmpiW (lpString1=".csv", lpString2=".cab") returned 1 [0052.538] lstrlenW (lpString=".cub") returned 4 [0052.538] lstrcmpiW (lpString1=".cub", lpString2=".cab") returned 1 [0052.538] lstrlenW (lpString=".dae") returned 4 [0052.538] lstrcmpiW (lpString1=".dae", lpString2=".cab") returned 1 [0052.538] lstrlenW (lpString=".dat") returned 4 [0052.538] lstrcmpiW (lpString1=".dat", lpString2=".cab") returned 1 [0052.538] lstrlenW (lpString=".db") returned 3 [0052.539] lstrcmpiW (lpString1=".db", lpString2="cab") returned -1 [0052.539] lstrlenW (lpString=".dbf") returned 4 [0052.539] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.539] lstrlenW (lpString=".dbx") returned 4 [0052.539] lstrcmpiW (lpString1=".dbx", lpString2=".cab") returned 1 [0052.539] lstrlenW (lpString=".dc3") returned 4 [0052.539] lstrcmpiW (lpString1=".dc3", lpString2=".cab") returned 1 [0052.539] lstrlenW (lpString=".dcm") returned 4 [0052.539] lstrcmpiW (lpString1=".dcm", lpString2=".cab") returned 1 [0052.539] lstrlenW (lpString=".dcr") returned 4 [0052.539] lstrcmpiW (lpString1=".dcr", lpString2=".cab") returned 1 [0052.539] lstrlenW (lpString=".der") returned 4 [0052.540] lstrcmpiW (lpString1=".der", lpString2=".cab") returned 1 [0052.540] lstrlenW (lpString=".dib") returned 4 [0052.540] lstrcmpiW (lpString1=".dib", lpString2=".cab") returned 1 [0052.540] lstrlenW (lpString=".dic") returned 4 [0052.540] lstrcmpiW (lpString1=".dic", lpString2=".cab") returned 1 [0052.540] lstrlenW (lpString=".dif") returned 4 [0052.540] lstrcmpiW (lpString1=".dif", lpString2=".cab") returned 1 [0052.540] lstrlenW (lpString=".divx") returned 5 [0052.540] lstrcmpiW (lpString1=".divx", lpString2="R.cab") returned -1 [0052.540] lstrlenW (lpString=".djvu") returned 5 [0052.540] lstrcmpiW (lpString1=".djvu", lpString2="R.cab") returned -1 [0052.540] lstrlenW (lpString=".dng") returned 4 [0052.540] lstrcmpiW (lpString1=".dng", lpString2=".cab") returned 1 [0052.540] lstrlenW (lpString=".doc") returned 4 [0052.540] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.540] lstrlenW (lpString=".docm") returned 5 [0052.540] lstrcmpiW (lpString1=".docm", lpString2="R.cab") returned -1 [0052.540] lstrlenW (lpString=".docx") returned 5 [0052.540] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.540] lstrlenW (lpString=".dot") returned 4 [0052.541] lstrcmpiW (lpString1=".dot", lpString2=".cab") returned 1 [0052.541] lstrlenW (lpString=".dotm") returned 5 [0052.541] lstrcmpiW (lpString1=".dotm", lpString2="R.cab") returned -1 [0052.541] lstrlenW (lpString=".dotx") returned 5 [0052.541] lstrcmpiW (lpString1=".dotx", lpString2="R.cab") returned -1 [0052.541] lstrlenW (lpString=".dpx") returned 4 [0052.541] lstrcmpiW (lpString1=".dpx", lpString2=".cab") returned 1 [0052.541] lstrlenW (lpString=".dqy") returned 4 [0052.541] lstrcmpiW (lpString1=".dqy", lpString2=".cab") returned 1 [0052.541] lstrlenW (lpString=".dsn") returned 4 [0052.541] lstrcmpiW (lpString1=".dsn", lpString2=".cab") returned 1 [0052.541] lstrlenW (lpString=".dt") returned 3 [0052.541] lstrcmpiW (lpString1=".dt", lpString2="cab") returned -1 [0052.541] lstrlenW (lpString=".dtd") returned 4 [0052.541] lstrcmpiW (lpString1=".dtd", lpString2=".cab") returned 1 [0052.541] lstrlenW (lpString=".dwg") returned 4 [0052.541] lstrcmpiW (lpString1=".dwg", lpString2=".cab") returned 1 [0052.541] lstrlenW (lpString=".dwt") returned 4 [0052.541] lstrcmpiW (lpString1=".dwt", lpString2=".cab") returned 1 [0052.541] lstrlenW (lpString=".dx") returned 3 [0052.541] lstrcmpiW (lpString1=".dx", lpString2="cab") returned -1 [0052.541] lstrlenW (lpString=".dxf") returned 4 [0052.541] lstrcmpiW (lpString1=".dxf", lpString2=".cab") returned 1 [0052.541] lstrlenW (lpString=".edml") returned 5 [0052.541] lstrcmpiW (lpString1=".edml", lpString2="R.cab") returned -1 [0052.541] lstrlenW (lpString=".efd") returned 4 [0052.542] lstrcmpiW (lpString1=".efd", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".elf") returned 4 [0052.542] lstrcmpiW (lpString1=".elf", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".emf") returned 4 [0052.542] lstrcmpiW (lpString1=".emf", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".emz") returned 4 [0052.542] lstrcmpiW (lpString1=".emz", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".epf") returned 4 [0052.542] lstrcmpiW (lpString1=".epf", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".eps") returned 4 [0052.542] lstrcmpiW (lpString1=".eps", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".epsf") returned 5 [0052.542] lstrcmpiW (lpString1=".epsf", lpString2="R.cab") returned -1 [0052.542] lstrlenW (lpString=".epsp") returned 5 [0052.542] lstrcmpiW (lpString1=".epsp", lpString2="R.cab") returned -1 [0052.542] lstrlenW (lpString=".erf") returned 4 [0052.542] lstrcmpiW (lpString1=".erf", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".exr") returned 4 [0052.542] lstrcmpiW (lpString1=".exr", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".f4v") returned 4 [0052.542] lstrcmpiW (lpString1=".f4v", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".fido") returned 5 [0052.542] lstrcmpiW (lpString1=".fido", lpString2="R.cab") returned -1 [0052.542] lstrlenW (lpString=".flm") returned 4 [0052.542] lstrcmpiW (lpString1=".flm", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".flv") returned 4 [0052.542] lstrcmpiW (lpString1=".flv", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".frm") returned 4 [0052.542] lstrcmpiW (lpString1=".frm", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".fxg") returned 4 [0052.542] lstrcmpiW (lpString1=".fxg", lpString2=".cab") returned 1 [0052.542] lstrlenW (lpString=".geo") returned 4 [0052.543] lstrcmpiW (lpString1=".geo", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".gif") returned 4 [0052.543] lstrcmpiW (lpString1=".gif", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".grs") returned 4 [0052.543] lstrcmpiW (lpString1=".grs", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".gz") returned 3 [0052.543] lstrcmpiW (lpString1=".gz", lpString2="cab") returned -1 [0052.543] lstrlenW (lpString=".h") returned 2 [0052.543] lstrcmpiW (lpString1=".h", lpString2="ab") returned -1 [0052.543] lstrlenW (lpString=".hdr") returned 4 [0052.543] lstrcmpiW (lpString1=".hdr", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".hpp") returned 4 [0052.543] lstrcmpiW (lpString1=".hpp", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".hta") returned 4 [0052.543] lstrcmpiW (lpString1=".hta", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".htc") returned 4 [0052.543] lstrcmpiW (lpString1=".htc", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".htm") returned 4 [0052.543] lstrcmpiW (lpString1=".htm", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".html") returned 5 [0052.543] lstrcmpiW (lpString1=".html", lpString2="R.cab") returned -1 [0052.543] lstrlenW (lpString=".icb") returned 4 [0052.543] lstrcmpiW (lpString1=".icb", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".ics") returned 4 [0052.543] lstrcmpiW (lpString1=".ics", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".iff") returned 4 [0052.543] lstrcmpiW (lpString1=".iff", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".inc") returned 4 [0052.543] lstrcmpiW (lpString1=".inc", lpString2=".cab") returned 1 [0052.543] lstrlenW (lpString=".indd") returned 5 [0052.543] lstrcmpiW (lpString1=".indd", lpString2="R.cab") returned -1 [0052.543] lstrlenW (lpString=".ini") returned 4 [0052.544] lstrcmpiW (lpString1=".ini", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".iqy") returned 4 [0052.544] lstrcmpiW (lpString1=".iqy", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".j2c") returned 4 [0052.544] lstrcmpiW (lpString1=".j2c", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".j2k") returned 4 [0052.544] lstrcmpiW (lpString1=".j2k", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".java") returned 5 [0052.544] lstrcmpiW (lpString1=".java", lpString2="R.cab") returned -1 [0052.544] lstrlenW (lpString=".jp2") returned 4 [0052.544] lstrcmpiW (lpString1=".jp2", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".jpc") returned 4 [0052.544] lstrcmpiW (lpString1=".jpc", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".jpe") returned 4 [0052.544] lstrcmpiW (lpString1=".jpe", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".jpeg") returned 5 [0052.544] lstrcmpiW (lpString1=".jpeg", lpString2="R.cab") returned -1 [0052.544] lstrlenW (lpString=".jpf") returned 4 [0052.544] lstrcmpiW (lpString1=".jpf", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".jpg") returned 4 [0052.544] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".jpx") returned 4 [0052.544] lstrcmpiW (lpString1=".jpx", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".js") returned 3 [0052.544] lstrcmpiW (lpString1=".js", lpString2="cab") returned -1 [0052.544] lstrlenW (lpString=".jsf") returned 4 [0052.544] lstrcmpiW (lpString1=".jsf", lpString2=".cab") returned 1 [0052.544] lstrlenW (lpString=".json") returned 5 [0052.544] lstrcmpiW (lpString1=".json", lpString2="R.cab") returned -1 [0052.545] lstrlenW (lpString=".jsp") returned 4 [0052.545] lstrcmpiW (lpString1=".jsp", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".kdc") returned 4 [0052.545] lstrcmpiW (lpString1=".kdc", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".kmz") returned 4 [0052.545] lstrcmpiW (lpString1=".kmz", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".kwm") returned 4 [0052.545] lstrcmpiW (lpString1=".kwm", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".lasso") returned 6 [0052.545] lstrcmpiW (lpString1=".lasso", lpString2="LR.cab") returned -1 [0052.545] lstrlenW (lpString=".lbi") returned 4 [0052.545] lstrcmpiW (lpString1=".lbi", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".lgf") returned 4 [0052.545] lstrcmpiW (lpString1=".lgf", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".lgp") returned 4 [0052.545] lstrcmpiW (lpString1=".lgp", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".log") returned 4 [0052.545] lstrcmpiW (lpString1=".log", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".m1v") returned 4 [0052.545] lstrcmpiW (lpString1=".m1v", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".m4a") returned 4 [0052.545] lstrcmpiW (lpString1=".m4a", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".m4v") returned 4 [0052.545] lstrcmpiW (lpString1=".m4v", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".max") returned 4 [0052.545] lstrcmpiW (lpString1=".max", lpString2=".cab") returned 1 [0052.545] lstrlenW (lpString=".md") returned 3 [0052.545] lstrcmpiW (lpString1=".md", lpString2="cab") returned -1 [0052.545] lstrlenW (lpString=".mda") returned 4 [0052.545] lstrcmpiW (lpString1=".mda", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mdb") returned 4 [0052.546] lstrcmpiW (lpString1=".mdb", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mde") returned 4 [0052.546] lstrcmpiW (lpString1=".mde", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mdf") returned 4 [0052.546] lstrcmpiW (lpString1=".mdf", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mdw") returned 4 [0052.546] lstrcmpiW (lpString1=".mdw", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mef") returned 4 [0052.546] lstrcmpiW (lpString1=".mef", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mft") returned 4 [0052.546] lstrcmpiW (lpString1=".mft", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mfw") returned 4 [0052.546] lstrcmpiW (lpString1=".mfw", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mht") returned 4 [0052.546] lstrcmpiW (lpString1=".mht", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mhtml") returned 6 [0052.546] lstrcmpiW (lpString1=".mhtml", lpString2="LR.cab") returned -1 [0052.546] lstrlenW (lpString=".mka") returned 4 [0052.546] lstrcmpiW (lpString1=".mka", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mkidx") returned 6 [0052.546] lstrcmpiW (lpString1=".mkidx", lpString2="LR.cab") returned -1 [0052.546] lstrlenW (lpString=".mkv") returned 4 [0052.546] lstrcmpiW (lpString1=".mkv", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mos") returned 4 [0052.546] lstrcmpiW (lpString1=".mos", lpString2=".cab") returned 1 [0052.546] lstrlenW (lpString=".mov") returned 4 [0052.546] lstrcmpiW (lpString1=".mov", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".mp3") returned 4 [0052.547] lstrcmpiW (lpString1=".mp3", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".mp4") returned 4 [0052.547] lstrcmpiW (lpString1=".mp4", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".mpeg") returned 5 [0052.547] lstrcmpiW (lpString1=".mpeg", lpString2="R.cab") returned -1 [0052.547] lstrlenW (lpString=".mpg") returned 4 [0052.547] lstrcmpiW (lpString1=".mpg", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".mpv") returned 4 [0052.547] lstrcmpiW (lpString1=".mpv", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".mrw") returned 4 [0052.547] lstrcmpiW (lpString1=".mrw", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".msg") returned 4 [0052.547] lstrcmpiW (lpString1=".msg", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".mxl") returned 4 [0052.547] lstrcmpiW (lpString1=".mxl", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".myd") returned 4 [0052.547] lstrcmpiW (lpString1=".myd", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".myi") returned 4 [0052.547] lstrcmpiW (lpString1=".myi", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".nef") returned 4 [0052.547] lstrcmpiW (lpString1=".nef", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".nrw") returned 4 [0052.547] lstrcmpiW (lpString1=".nrw", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".obj") returned 4 [0052.547] lstrcmpiW (lpString1=".obj", lpString2=".cab") returned 1 [0052.547] lstrlenW (lpString=".odb") returned 4 [0052.548] lstrcmpiW (lpString1=".odb", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".odc") returned 4 [0052.548] lstrcmpiW (lpString1=".odc", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".odm") returned 4 [0052.548] lstrcmpiW (lpString1=".odm", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".odp") returned 4 [0052.548] lstrcmpiW (lpString1=".odp", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".ods") returned 4 [0052.548] lstrcmpiW (lpString1=".ods", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".oft") returned 4 [0052.548] lstrcmpiW (lpString1=".oft", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".one") returned 4 [0052.548] lstrcmpiW (lpString1=".one", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".onepkg") returned 7 [0052.548] lstrcmpiW (lpString1=".onepkg", lpString2="kLR.cab") returned -1 [0052.548] lstrlenW (lpString=".onetoc2") returned 8 [0052.548] lstrcmpiW (lpString1=".onetoc2", lpString2="lkLR.cab") returned -1 [0052.548] lstrlenW (lpString=".opt") returned 4 [0052.548] lstrcmpiW (lpString1=".opt", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".oqy") returned 4 [0052.548] lstrcmpiW (lpString1=".oqy", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".orf") returned 4 [0052.548] lstrcmpiW (lpString1=".orf", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".p12") returned 4 [0052.548] lstrcmpiW (lpString1=".p12", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".p7b") returned 4 [0052.548] lstrcmpiW (lpString1=".p7b", lpString2=".cab") returned 1 [0052.548] lstrlenW (lpString=".p7c") returned 4 [0052.548] lstrcmpiW (lpString1=".p7c", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pam") returned 4 [0052.549] lstrcmpiW (lpString1=".pam", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pbm") returned 4 [0052.549] lstrcmpiW (lpString1=".pbm", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pct") returned 4 [0052.549] lstrcmpiW (lpString1=".pct", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pcx") returned 4 [0052.549] lstrcmpiW (lpString1=".pcx", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pdd") returned 4 [0052.549] lstrcmpiW (lpString1=".pdd", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pdf") returned 4 [0052.549] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pdp") returned 4 [0052.549] lstrcmpiW (lpString1=".pdp", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pef") returned 4 [0052.549] lstrcmpiW (lpString1=".pef", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pem") returned 4 [0052.549] lstrcmpiW (lpString1=".pem", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pff") returned 4 [0052.549] lstrcmpiW (lpString1=".pff", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pfm") returned 4 [0052.549] lstrcmpiW (lpString1=".pfm", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pfx") returned 4 [0052.549] lstrcmpiW (lpString1=".pfx", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".pgm") returned 4 [0052.549] lstrcmpiW (lpString1=".pgm", lpString2=".cab") returned 1 [0052.549] lstrlenW (lpString=".php") returned 4 [0052.549] lstrcmpiW (lpString1=".php", lpString2=".cab") returned 1 [0052.550] lstrlenW (lpString=".php3") returned 5 [0052.550] lstrcmpiW (lpString1=".php3", lpString2="R.cab") returned -1 [0052.550] lstrlenW (lpString=".php4") returned 5 [0052.550] lstrcmpiW (lpString1=".php4", lpString2="R.cab") returned -1 [0052.550] lstrlenW (lpString=".php5") returned 5 [0052.550] lstrcmpiW (lpString1=".php5", lpString2="R.cab") returned -1 [0052.550] lstrlenW (lpString=".phtml") returned 6 [0052.550] lstrcmpiW (lpString1=".phtml", lpString2="LR.cab") returned -1 [0052.550] lstrlenW (lpString=".pict") returned 5 [0052.550] lstrcmpiW (lpString1=".pict", lpString2="R.cab") returned -1 [0052.550] lstrlenW (lpString=".pl") returned 3 [0052.550] lstrcmpiW (lpString1=".pl", lpString2="cab") returned -1 [0052.550] lstrlenW (lpString=".pls") returned 4 [0052.550] lstrcmpiW (lpString1=".pls", lpString2=".cab") returned 1 [0052.550] lstrlenW (lpString=".pm") returned 3 [0052.550] lstrcmpiW (lpString1=".pm", lpString2="cab") returned -1 [0052.550] lstrlenW (lpString=".png") returned 4 [0052.550] lstrcmpiW (lpString1=".png", lpString2=".cab") returned 1 [0052.550] lstrlenW (lpString=".pnm") returned 4 [0052.550] lstrcmpiW (lpString1=".pnm", lpString2=".cab") returned 1 [0052.550] lstrlenW (lpString=".pot") returned 4 [0052.550] lstrcmpiW (lpString1=".pot", lpString2=".cab") returned 1 [0052.550] lstrlenW (lpString=".potm") returned 5 [0052.550] lstrcmpiW (lpString1=".potm", lpString2="R.cab") returned -1 [0052.550] lstrlenW (lpString=".potx") returned 5 [0052.550] lstrcmpiW (lpString1=".potx", lpString2="R.cab") returned -1 [0052.550] lstrlenW (lpString=".ppa") returned 4 [0052.550] lstrcmpiW (lpString1=".ppa", lpString2=".cab") returned 1 [0052.550] lstrlenW (lpString=".ppam") returned 5 [0052.550] lstrcmpiW (lpString1=".ppam", lpString2="R.cab") returned -1 [0052.551] lstrlenW (lpString=".ppm") returned 4 [0052.551] lstrcmpiW (lpString1=".ppm", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".pps") returned 4 [0052.551] lstrcmpiW (lpString1=".pps", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".ppsm") returned 5 [0052.551] lstrcmpiW (lpString1=".ppsm", lpString2="R.cab") returned -1 [0052.551] lstrlenW (lpString=".ppt") returned 4 [0052.551] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".pptm") returned 5 [0052.551] lstrcmpiW (lpString1=".pptm", lpString2="R.cab") returned -1 [0052.551] lstrlenW (lpString=".pptx") returned 5 [0052.551] lstrcmpiW (lpString1=".pptx", lpString2="R.cab") returned -1 [0052.551] lstrlenW (lpString=".prn") returned 4 [0052.551] lstrcmpiW (lpString1=".prn", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".ps") returned 3 [0052.551] lstrcmpiW (lpString1=".ps", lpString2="cab") returned -1 [0052.551] lstrlenW (lpString=".psb") returned 4 [0052.551] lstrcmpiW (lpString1=".psb", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".psd") returned 4 [0052.551] lstrcmpiW (lpString1=".psd", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".pst") returned 4 [0052.551] lstrcmpiW (lpString1=".pst", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".ptx") returned 4 [0052.551] lstrcmpiW (lpString1=".ptx", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".pub") returned 4 [0052.551] lstrcmpiW (lpString1=".pub", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".pwm") returned 4 [0052.551] lstrcmpiW (lpString1=".pwm", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".pxr") returned 4 [0052.551] lstrcmpiW (lpString1=".pxr", lpString2=".cab") returned 1 [0052.551] lstrlenW (lpString=".py") returned 3 [0052.551] lstrcmpiW (lpString1=".py", lpString2="cab") returned -1 [0052.551] lstrlenW (lpString=".qt") returned 3 [0052.551] lstrcmpiW (lpString1=".qt", lpString2="cab") returned -1 [0052.552] lstrlenW (lpString=".r3d") returned 4 [0052.552] lstrcmpiW (lpString1=".r3d", lpString2=".cab") returned 1 [0052.552] lstrlenW (lpString=".raf") returned 4 [0052.552] lstrcmpiW (lpString1=".raf", lpString2=".cab") returned 1 [0052.552] lstrlenW (lpString=".rar") returned 4 [0052.552] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.552] lstrlenW (lpString=".raw") returned 4 [0052.552] lstrcmpiW (lpString1=".raw", lpString2=".cab") returned 1 [0052.552] FindNextFileW (in: hFindFile=0x3f33098, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0052.553] FindClose (in: hFindFile=0x3f33098 | out: hFindFile=0x3f33098) returned 1 [0053.039] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ed1058 | out: hHeap=0x5e0000) returned 1 [0053.040] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0053.784] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.784] lstrcmpiW (lpString1=".3ds", lpString2=".msi") returned -1 [0053.784] lstrcmpiW (lpString1=".3fr", lpString2=".msi") returned -1 [0053.784] lstrcmpiW (lpString1=".3g2", lpString2=".msi") returned -1 [0053.784] lstrcmpiW (lpString1=".3gp", lpString2=".msi") returned -1 [0053.784] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.784] lstrcmpiW (lpString1=".accda", lpString2="UI.msi") returned -1 [0053.784] lstrcmpiW (lpString1=".accdb", lpString2="UI.msi") returned -1 [0053.784] lstrcmpiW (lpString1=".accdc", lpString2="UI.msi") returned -1 [0053.784] lstrcmpiW (lpString1=".accde", lpString2="UI.msi") returned -1 [0053.784] lstrcmpiW (lpString1=".accdt", lpString2="UI.msi") returned -1 [0053.784] lstrcmpiW (lpString1=".accdw", lpString2="UI.msi") returned -1 [0053.784] lstrcmpiW (lpString1=".adb", lpString2=".msi") returned -1 [0053.784] lstrcmpiW (lpString1=".adp", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".ai", lpString2="msi") returned -1 [0053.785] lstrcmpiW (lpString1=".ai3", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".ai4", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".ai5", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".ai6", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".ai7", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".ai8", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".anim", lpString2="I.msi") returned -1 [0053.785] lstrcmpiW (lpString1=".arw", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".as", lpString2="msi") returned -1 [0053.785] lstrcmpiW (lpString1=".asa", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".asc", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".ascx", lpString2="I.msi") returned -1 [0053.785] lstrcmpiW (lpString1=".asm", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".asmx", lpString2="I.msi") returned -1 [0053.785] lstrcmpiW (lpString1=".asp", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".aspx", lpString2="I.msi") returned -1 [0053.785] lstrcmpiW (lpString1=".asr", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".asx", lpString2=".msi") returned -1 [0053.785] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".avs", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".backup", lpString2="MUI.msi") returned -1 [0053.786] lstrcmpiW (lpString1=".bak", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".bay", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".bd", lpString2="msi") returned -1 [0053.786] lstrcmpiW (lpString1=".bin", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".bmp", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".c", lpString2="si") returned -1 [0053.786] lstrcmpiW (lpString1=".cdr", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".cer", lpString2=".msi") returned -1 [0053.786] lstrcmpiW (lpString1=".cf", lpString2="msi") returned -1 [0053.786] lstrcmpiW (lpString1=".cfc", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".cfm", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".cfml", lpString2="I.msi") returned -1 [0053.787] lstrcmpiW (lpString1=".cfu", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".chm", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".cin", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".class", lpString2="UI.msi") returned -1 [0053.787] lstrcmpiW (lpString1=".clx", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".config", lpString2="MUI.msi") returned -1 [0053.787] lstrcmpiW (lpString1=".cpp", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".cr2", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".crt", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".crw", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".cs", lpString2="msi") returned -1 [0053.787] lstrcmpiW (lpString1=".css", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".csv", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".cub", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".dae", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0053.787] lstrcmpiW (lpString1=".db", lpString2="msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dbx", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dc3", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dcm", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dcr", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".der", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dib", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dic", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dif", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".divx", lpString2="I.msi") returned -1 [0053.788] lstrcmpiW (lpString1=".djvu", lpString2="I.msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dng", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".docm", lpString2="I.msi") returned -1 [0053.788] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dot", lpString2=".msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dotm", lpString2="I.msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dotx", lpString2="I.msi") returned -1 [0053.788] lstrcmpiW (lpString1=".dpx", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".dqy", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".dsn", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".dt", lpString2="msi") returned -1 [0053.789] lstrcmpiW (lpString1=".dtd", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".dwg", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".dwt", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".dx", lpString2="msi") returned -1 [0053.789] lstrcmpiW (lpString1=".dxf", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".edml", lpString2="I.msi") returned -1 [0053.789] lstrcmpiW (lpString1=".efd", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".elf", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".emz", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".epf", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".eps", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".epsf", lpString2="I.msi") returned -1 [0053.789] lstrcmpiW (lpString1=".epsp", lpString2="I.msi") returned -1 [0053.789] lstrcmpiW (lpString1=".erf", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".exr", lpString2=".msi") returned -1 [0053.789] lstrcmpiW (lpString1=".f4v", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".fido", lpString2="I.msi") returned -1 [0053.790] lstrcmpiW (lpString1=".flm", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".flv", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".frm", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".fxg", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".geo", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".grs", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".gz", lpString2="msi") returned -1 [0053.790] lstrcmpiW (lpString1=".h", lpString2="si") returned -1 [0053.790] lstrcmpiW (lpString1=".hdr", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".hpp", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".hta", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".htc", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0053.790] lstrcmpiW (lpString1=".html", lpString2="I.msi") returned -1 [0053.790] lstrcmpiW (lpString1=".icb", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".ics", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".iff", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".indd", lpString2="I.msi") returned -1 [0053.791] lstrcmpiW (lpString1=".ini", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".iqy", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".j2c", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".j2k", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".java", lpString2="I.msi") returned -1 [0053.791] lstrcmpiW (lpString1=".jp2", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".jpc", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".jpe", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".jpeg", lpString2="I.msi") returned -1 [0053.791] lstrcmpiW (lpString1=".jpf", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".jpx", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".js", lpString2="msi") returned -1 [0053.791] lstrcmpiW (lpString1=".jsf", lpString2=".msi") returned -1 [0053.791] lstrcmpiW (lpString1=".json", lpString2="I.msi") returned -1 [0053.792] lstrcmpiW (lpString1=".jsp", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".kdc", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".kmz", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".kwm", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".lasso", lpString2="UI.msi") returned -1 [0053.792] lstrcmpiW (lpString1=".lbi", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".lgf", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".lgp", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".log", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".m1v", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".m4a", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".m4v", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".max", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".md", lpString2="msi") returned -1 [0053.792] lstrcmpiW (lpString1=".mda", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".mdb", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".mde", lpString2=".msi") returned -1 [0053.792] lstrcmpiW (lpString1=".mdf", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mdw", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mef", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mft", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mfw", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mht", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mhtml", lpString2="UI.msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mka", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mkidx", lpString2="UI.msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mkv", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mos", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mov", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mp3", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mp4", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mpeg", lpString2="I.msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mpg", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mpv", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mrw", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".msg", lpString2=".msi") returned -1 [0053.793] lstrcmpiW (lpString1=".mxl", lpString2=".msi") returned 1 [0053.793] lstrcmpiW (lpString1=".myd", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".myi", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".nef", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".nrw", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".obj", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".odb", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".odc", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".odm", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".odp", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".ods", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".oft", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".one", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.msi") returned -1 [0053.794] lstrcmpiW (lpString1=".onetoc2", lpString2="tMUI.msi") returned -1 [0053.794] lstrcmpiW (lpString1=".opt", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".oqy", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".orf", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".p12", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".p7b", lpString2=".msi") returned 1 [0053.794] lstrcmpiW (lpString1=".p7c", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pam", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pbm", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pct", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pcx", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pdd", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pdp", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pef", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pem", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pff", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pfm", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pfx", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".pgm", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".php", lpString2=".msi") returned 1 [0053.795] lstrcmpiW (lpString1=".php3", lpString2="I.msi") returned -1 [0053.795] lstrcmpiW (lpString1=".php4", lpString2="I.msi") returned -1 [0053.795] lstrcmpiW (lpString1=".php5", lpString2="I.msi") returned -1 [0053.795] lstrcmpiW (lpString1=".phtml", lpString2="UI.msi") returned -1 [0053.795] lstrcmpiW (lpString1=".pict", lpString2="I.msi") returned -1 [0053.796] lstrcmpiW (lpString1=".pl", lpString2="msi") returned -1 [0053.796] lstrcmpiW (lpString1=".pls", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".pm", lpString2="msi") returned -1 [0053.796] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".pnm", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".pot", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".potm", lpString2="I.msi") returned -1 [0053.796] lstrcmpiW (lpString1=".potx", lpString2="I.msi") returned -1 [0053.796] lstrcmpiW (lpString1=".ppa", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".ppam", lpString2="I.msi") returned -1 [0053.796] lstrcmpiW (lpString1=".ppm", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".pps", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".ppsm", lpString2="I.msi") returned -1 [0053.796] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".pptm", lpString2="I.msi") returned -1 [0053.796] lstrcmpiW (lpString1=".pptx", lpString2="I.msi") returned -1 [0053.796] lstrcmpiW (lpString1=".prn", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".ps", lpString2="msi") returned -1 [0053.796] lstrcmpiW (lpString1=".psb", lpString2=".msi") returned 1 [0053.796] lstrcmpiW (lpString1=".psd", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".pst", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".ptx", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".pub", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".pwm", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".pxr", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".py", lpString2="msi") returned -1 [0053.797] lstrcmpiW (lpString1=".qt", lpString2="msi") returned -1 [0053.797] lstrcmpiW (lpString1=".r3d", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".raf", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".raw", lpString2=".msi") returned 1 [0053.797] lstrcmpiW (lpString1=".rdf", lpString2=".msi") returned 1 Thread: id = 19 os_tid = 0xa80 [0051.673] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39306d8 [0051.674] lstrlenW (lpString="C:") returned 2 [0051.674] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x353fd00 | out: lpFindFileData=0x353fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x65fd28 [0051.674] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0051.674] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0051.674] lstrlenW (lpString="$Recycle.Bin") returned 12 [0051.675] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0051.675] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39406e0 [0051.675] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0051.675] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fd68 [0051.675] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.675] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0051.676] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0051.676] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0051.676] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0051.676] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0051.676] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.676] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0051.676] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.676] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.677] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.677] lstrlenW (lpString="desktop.ini") returned 11 [0051.677] lstrlenW (lpString=".1cd") returned 4 [0051.677] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.677] lstrlenW (lpString=".3ds") returned 4 [0051.677] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0051.677] lstrlenW (lpString=".3fr") returned 4 [0051.677] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0051.677] lstrlenW (lpString=".3g2") returned 4 [0051.677] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0051.677] lstrlenW (lpString=".3gp") returned 4 [0051.677] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0051.677] lstrlenW (lpString=".7z") returned 3 [0051.677] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.677] lstrlenW (lpString=".accda") returned 6 [0051.677] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0051.677] lstrlenW (lpString=".accdb") returned 6 [0051.677] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0051.677] lstrlenW (lpString=".accdc") returned 6 [0051.677] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0051.677] lstrlenW (lpString=".accde") returned 6 [0051.678] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0051.678] lstrlenW (lpString=".accdt") returned 6 [0051.678] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0051.678] lstrlenW (lpString=".accdw") returned 6 [0051.678] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0051.678] lstrlenW (lpString=".adb") returned 4 [0051.678] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0051.678] lstrlenW (lpString=".adp") returned 4 [0051.678] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0051.678] lstrlenW (lpString=".ai") returned 3 [0051.678] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0051.678] lstrlenW (lpString=".ai3") returned 4 [0051.678] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0051.678] lstrlenW (lpString=".ai4") returned 4 [0051.678] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0051.678] lstrlenW (lpString=".ai5") returned 4 [0051.678] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0051.678] lstrlenW (lpString=".ai6") returned 4 [0051.678] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0051.678] lstrlenW (lpString=".ai7") returned 4 [0051.678] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0051.678] lstrlenW (lpString=".ai8") returned 4 [0051.678] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0051.678] lstrlenW (lpString=".anim") returned 5 [0051.678] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0051.679] lstrlenW (lpString=".arw") returned 4 [0051.679] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".as") returned 3 [0051.679] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0051.679] lstrlenW (lpString=".asa") returned 4 [0051.679] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".asc") returned 4 [0051.679] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".ascx") returned 5 [0051.679] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0051.679] lstrlenW (lpString=".asm") returned 4 [0051.679] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".asmx") returned 5 [0051.679] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0051.679] lstrlenW (lpString=".asp") returned 4 [0051.679] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".aspx") returned 5 [0051.679] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0051.679] lstrlenW (lpString=".asr") returned 4 [0051.679] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".asx") returned 4 [0051.679] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".avi") returned 4 [0051.679] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".avs") returned 4 [0051.679] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0051.679] lstrlenW (lpString=".backup") returned 7 [0051.679] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0051.679] lstrlenW (lpString=".bak") returned 4 [0051.680] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0051.680] lstrlenW (lpString=".bay") returned 4 [0051.680] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0051.680] lstrlenW (lpString=".bd") returned 3 [0051.680] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0051.680] lstrlenW (lpString=".bin") returned 4 [0051.680] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0051.680] lstrlenW (lpString=".bmp") returned 4 [0051.680] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0051.680] lstrlenW (lpString=".bz2") returned 4 [0051.680] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.680] lstrlenW (lpString=".c") returned 2 [0051.680] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0051.680] lstrlenW (lpString=".cdr") returned 4 [0051.680] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0051.680] lstrlenW (lpString=".cer") returned 4 [0051.680] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0051.680] lstrlenW (lpString=".cf") returned 3 [0051.680] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0051.680] lstrlenW (lpString=".cfc") returned 4 [0051.681] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0051.681] lstrlenW (lpString=".cfm") returned 4 [0051.681] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0051.681] lstrlenW (lpString=".cfml") returned 5 [0051.681] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0051.681] lstrlenW (lpString=".cfu") returned 4 [0051.681] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0051.681] lstrlenW (lpString=".chm") returned 4 [0051.681] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0051.681] lstrlenW (lpString=".cin") returned 4 [0051.681] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0051.681] lstrlenW (lpString=".class") returned 6 [0051.681] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0051.681] lstrlenW (lpString=".clx") returned 4 [0051.681] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0051.681] lstrlenW (lpString=".config") returned 7 [0051.681] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0051.682] lstrlenW (lpString=".cpp") returned 4 [0051.682] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".cr2") returned 4 [0051.682] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".crt") returned 4 [0051.682] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".crw") returned 4 [0051.682] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".cs") returned 3 [0051.682] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0051.682] lstrlenW (lpString=".css") returned 4 [0051.682] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".csv") returned 4 [0051.682] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".cub") returned 4 [0051.682] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".dae") returned 4 [0051.682] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".dat") returned 4 [0051.682] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".db") returned 3 [0051.682] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0051.682] lstrlenW (lpString=".dbf") returned 4 [0051.682] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".dbx") returned 4 [0051.682] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".dc3") returned 4 [0051.682] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".dcm") returned 4 [0051.682] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0051.682] lstrlenW (lpString=".dcr") returned 4 [0051.683] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".der") returned 4 [0051.683] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".dib") returned 4 [0051.683] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".dic") returned 4 [0051.683] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".dif") returned 4 [0051.683] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".divx") returned 5 [0051.683] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0051.683] lstrlenW (lpString=".djvu") returned 5 [0051.683] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0051.683] lstrlenW (lpString=".dng") returned 4 [0051.683] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".doc") returned 4 [0051.683] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".docm") returned 5 [0051.683] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0051.683] lstrlenW (lpString=".docx") returned 5 [0051.683] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0051.683] lstrlenW (lpString=".dot") returned 4 [0051.683] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".dotm") returned 5 [0051.683] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0051.683] lstrlenW (lpString=".dotx") returned 5 [0051.683] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0051.683] lstrlenW (lpString=".dpx") returned 4 [0051.683] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0051.683] lstrlenW (lpString=".dqy") returned 4 [0051.684] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".dsn") returned 4 [0051.684] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".dt") returned 3 [0051.684] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0051.684] lstrlenW (lpString=".dtd") returned 4 [0051.684] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".dwg") returned 4 [0051.684] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".dwt") returned 4 [0051.684] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".dx") returned 3 [0051.684] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0051.684] lstrlenW (lpString=".dxf") returned 4 [0051.684] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".edml") returned 5 [0051.684] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0051.684] lstrlenW (lpString=".efd") returned 4 [0051.684] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".elf") returned 4 [0051.684] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".emf") returned 4 [0051.684] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".emz") returned 4 [0051.684] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".epf") returned 4 [0051.684] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0051.684] lstrlenW (lpString=".eps") returned 4 [0051.684] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".epsf") returned 5 [0051.685] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0051.685] lstrlenW (lpString=".epsp") returned 5 [0051.685] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0051.685] lstrlenW (lpString=".erf") returned 4 [0051.685] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".exr") returned 4 [0051.685] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".f4v") returned 4 [0051.685] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".fido") returned 5 [0051.685] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0051.685] lstrlenW (lpString=".flm") returned 4 [0051.685] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".flv") returned 4 [0051.685] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".frm") returned 4 [0051.685] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".fxg") returned 4 [0051.685] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".geo") returned 4 [0051.685] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".gif") returned 4 [0051.685] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".grs") returned 4 [0051.685] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0051.685] lstrlenW (lpString=".gz") returned 3 [0051.685] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0051.685] lstrlenW (lpString=".h") returned 2 [0051.685] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0051.685] lstrlenW (lpString=".hdr") returned 4 [0051.685] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".hpp") returned 4 [0051.686] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".hta") returned 4 [0051.686] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".htc") returned 4 [0051.686] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".htm") returned 4 [0051.686] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".html") returned 5 [0051.686] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0051.686] lstrlenW (lpString=".icb") returned 4 [0051.686] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".ics") returned 4 [0051.686] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".iff") returned 4 [0051.686] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".inc") returned 4 [0051.686] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0051.686] lstrlenW (lpString=".indd") returned 5 [0051.686] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0051.686] lstrlenW (lpString=".ini") returned 4 [0051.686] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0051.686] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0051.686] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.686] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.686] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0051.686] FindClose (in: hFindFile=0x65fd68 | out: hFindFile=0x65fd68) returned 1 [0051.686] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39406e0 | out: hHeap=0x5e0000) returned 1 [0051.686] FindNextFileW (in: hFindFile=0x65fd28, lpFindFileData=0x353fd00 | out: lpFindFileData=0x353fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0051.686] lstrlenW (lpString="C:\\Boot") returned 7 [0051.687] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0051.687] lstrlenW (lpString="Boot") returned 4 [0051.687] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0051.687] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39406e0 [0051.687] lstrlenW (lpString="C:\\Boot") returned 7 [0051.687] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fd68 [0051.687] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.687] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0051.687] lstrlenW (lpString="BCD") returned 3 [0051.687] lstrlenW (lpString=".1cd") returned 4 [0051.687] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0051.687] lstrlenW (lpString=".3ds") returned 4 [0051.687] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0051.687] lstrlenW (lpString=".3fr") returned 4 [0051.687] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0051.687] lstrlenW (lpString=".3g2") returned 4 [0051.687] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0051.687] lstrlenW (lpString=".3gp") returned 4 [0051.687] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0051.687] lstrlenW (lpString=".7z") returned 3 [0051.687] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0051.687] lstrlenW (lpString=".accda") returned 6 [0051.687] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".accdb") returned 6 [0051.688] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".accdc") returned 6 [0051.688] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".accde") returned 6 [0051.688] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".accdt") returned 6 [0051.688] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".accdw") returned 6 [0051.688] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".adb") returned 4 [0051.688] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".adp") returned 4 [0051.688] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".ai") returned 3 [0051.688] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0051.688] lstrlenW (lpString=".ai3") returned 4 [0051.688] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".ai4") returned 4 [0051.688] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".ai5") returned 4 [0051.688] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".ai6") returned 4 [0051.688] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".ai7") returned 4 [0051.688] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".ai8") returned 4 [0051.688] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".anim") returned 5 [0051.688] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".arw") returned 4 [0051.688] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0051.688] lstrlenW (lpString=".as") returned 3 [0051.688] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0051.689] lstrlenW (lpString=".asa") returned 4 [0051.689] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".asc") returned 4 [0051.689] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".ascx") returned 5 [0051.689] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".asm") returned 4 [0051.689] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".asmx") returned 5 [0051.689] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".asp") returned 4 [0051.689] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".aspx") returned 5 [0051.689] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".asr") returned 4 [0051.689] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".asx") returned 4 [0051.689] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".avi") returned 4 [0051.689] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".avs") returned 4 [0051.689] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".backup") returned 7 [0051.689] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".bak") returned 4 [0051.689] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".bay") returned 4 [0051.689] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0051.689] lstrlenW (lpString=".bd") returned 3 [0051.689] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0051.689] lstrlenW (lpString=".bin") returned 4 [0051.689] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".bmp") returned 4 [0051.690] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".bz2") returned 4 [0051.690] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".c") returned 2 [0051.690] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0051.690] lstrlenW (lpString=".cdr") returned 4 [0051.690] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".cer") returned 4 [0051.690] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".cf") returned 3 [0051.690] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0051.690] lstrlenW (lpString=".cfc") returned 4 [0051.690] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".cfm") returned 4 [0051.690] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".cfml") returned 5 [0051.690] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".cfu") returned 4 [0051.690] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".chm") returned 4 [0051.690] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".cin") returned 4 [0051.690] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".class") returned 6 [0051.690] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".clx") returned 4 [0051.690] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0051.690] lstrlenW (lpString=".config") returned 7 [0051.690] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".cpp") returned 4 [0051.691] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".cr2") returned 4 [0051.691] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".crt") returned 4 [0051.691] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".crw") returned 4 [0051.691] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".cs") returned 3 [0051.691] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0051.691] lstrlenW (lpString=".css") returned 4 [0051.691] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".csv") returned 4 [0051.691] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".cub") returned 4 [0051.691] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".dae") returned 4 [0051.691] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".dat") returned 4 [0051.691] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".db") returned 3 [0051.691] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0051.691] lstrlenW (lpString=".dbf") returned 4 [0051.691] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".dbx") returned 4 [0051.691] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".dc3") returned 4 [0051.691] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0051.691] lstrlenW (lpString=".dcm") returned 4 [0051.692] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dcr") returned 4 [0051.692] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".der") returned 4 [0051.692] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dib") returned 4 [0051.692] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dic") returned 4 [0051.692] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dif") returned 4 [0051.692] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".divx") returned 5 [0051.692] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".djvu") returned 5 [0051.692] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dng") returned 4 [0051.692] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".doc") returned 4 [0051.692] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".docm") returned 5 [0051.692] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".docx") returned 5 [0051.692] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dot") returned 4 [0051.692] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dotm") returned 5 [0051.692] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dotx") returned 5 [0051.692] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dpx") returned 4 [0051.692] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0051.692] lstrlenW (lpString=".dqy") returned 4 [0051.693] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".dsn") returned 4 [0051.693] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".dt") returned 3 [0051.693] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0051.693] lstrlenW (lpString=".dtd") returned 4 [0051.693] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".dwg") returned 4 [0051.693] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".dwt") returned 4 [0051.693] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".dx") returned 3 [0051.693] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0051.693] lstrlenW (lpString=".dxf") returned 4 [0051.693] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".edml") returned 5 [0051.693] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".efd") returned 4 [0051.693] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".elf") returned 4 [0051.693] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".emf") returned 4 [0051.693] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".emz") returned 4 [0051.693] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".epf") returned 4 [0051.693] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".eps") returned 4 [0051.693] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0051.693] lstrlenW (lpString=".epsf") returned 5 [0051.694] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".epsp") returned 5 [0051.694] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".erf") returned 4 [0051.694] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".exr") returned 4 [0051.694] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".f4v") returned 4 [0051.694] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".fido") returned 5 [0051.694] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".flm") returned 4 [0051.694] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".flv") returned 4 [0051.694] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".frm") returned 4 [0051.694] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0051.694] lstrlenW (lpString=".fxg") returned 4 [0051.694] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0051.694] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.694] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.695] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.695] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.696] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.696] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.696] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0051.696] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.696] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.697] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.697] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.697] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.697] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.697] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0051.697] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0051.697] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.698] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.699] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.699] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.699] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x5e0000) returned 1 [0051.699] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0051.699] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.699] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.699] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.699] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.699] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.700] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.700] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.700] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.700] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.701] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.701] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.701] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.701] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.701] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0051.701] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.701] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.702] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.702] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.702] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.702] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.702] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0051.702] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.702] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.703] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.703] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.703] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.703] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.703] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0051.703] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.703] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.704] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0051.705] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.705] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.705] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0051.705] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.705] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.706] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.706] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.706] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0051.706] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.706] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.706] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.707] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.707] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.707] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0051.707] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.707] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.708] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.708] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.708] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.708] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.708] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0051.708] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.708] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.708] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.708] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.708] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.708] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.708] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0051.708] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.708] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.709] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.709] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.709] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.710] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.710] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0051.710] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.710] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0051.710] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.710] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.710] FindClose (in: hFindFile=0x65fda8 | out: hFindFile=0x65fda8) returned 1 [0051.710] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.710] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0051.711] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.711] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fde8 [0051.712] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.712] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.712] FindClose (in: hFindFile=0x65fde8 | out: hFindFile=0x65fde8) returned 1 [0051.712] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.712] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0051.713] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.713] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fde8 [0051.713] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.713] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.713] FindClose (in: hFindFile=0x65fde8 | out: hFindFile=0x65fde8) returned 1 [0051.713] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.713] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0051.713] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.713] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fde8 [0051.714] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.714] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.714] FindClose (in: hFindFile=0x65fde8 | out: hFindFile=0x65fde8) returned 1 [0051.714] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.714] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0051.715] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.715] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fde8 [0051.715] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.715] FindNextFileW (in: hFindFile=0x65fde8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.715] FindClose (in: hFindFile=0x65fde8 | out: hFindFile=0x65fde8) returned 1 [0051.715] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x5e0000) returned 1 [0051.715] FindNextFileW (in: hFindFile=0x65fd68, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0051.715] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0051.715] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65fda8 [0052.041] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.041] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.439] FindNextFileW (in: hFindFile=0x6d57d0, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.439] FindNextFileW (in: hFindFile=0x6d57d0, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0052.439] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned 1 [0052.439] lstrlenW (lpString="Proof.en") returned 8 [0052.440] lstrcmpiW (lpString1="C:\\Windows", lpString2="Proof.en") returned -1 [0052.440] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x3ee2068 [0052.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned 71 [0052.440] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5810 [0052.440] FindNextFileW (in: hFindFile=0x6d5810, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.441] FindNextFileW (in: hFindFile=0x6d5810, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.441] lstrlenW (lpString="Proof.cab") returned 9 [0052.441] lstrlenW (lpString=".1cd") returned 4 [0052.441] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.441] lstrlenW (lpString=".3ds") returned 4 [0052.441] lstrcmpiW (lpString1=".3ds", lpString2=".cab") returned -1 [0052.441] lstrlenW (lpString=".3fr") returned 4 [0052.441] lstrcmpiW (lpString1=".3fr", lpString2=".cab") returned -1 [0052.441] lstrlenW (lpString=".3g2") returned 4 [0052.441] lstrcmpiW (lpString1=".3g2", lpString2=".cab") returned -1 [0052.441] lstrlenW (lpString=".3gp") returned 4 [0052.441] lstrcmpiW (lpString1=".3gp", lpString2=".cab") returned -1 [0052.441] lstrlenW (lpString=".7z") returned 3 [0052.441] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.441] lstrlenW (lpString=".accda") returned 6 [0052.441] lstrcmpiW (lpString1=".accda", lpString2="of.cab") returned -1 [0052.441] lstrlenW (lpString=".accdb") returned 6 [0052.441] lstrcmpiW (lpString1=".accdb", lpString2="of.cab") returned -1 [0052.441] lstrlenW (lpString=".accdc") returned 6 [0052.441] lstrcmpiW (lpString1=".accdc", lpString2="of.cab") returned -1 [0052.441] lstrlenW (lpString=".accde") returned 6 [0052.441] lstrcmpiW (lpString1=".accde", lpString2="of.cab") returned -1 [0052.441] lstrlenW (lpString=".accdt") returned 6 [0052.441] lstrcmpiW (lpString1=".accdt", lpString2="of.cab") returned -1 [0052.442] lstrlenW (lpString=".accdw") returned 6 [0052.442] lstrcmpiW (lpString1=".accdw", lpString2="of.cab") returned -1 [0052.442] lstrlenW (lpString=".adb") returned 4 [0052.442] lstrcmpiW (lpString1=".adb", lpString2=".cab") returned -1 [0052.442] lstrlenW (lpString=".adp") returned 4 [0052.442] lstrcmpiW (lpString1=".adp", lpString2=".cab") returned -1 [0052.442] lstrlenW (lpString=".ai") returned 3 [0052.442] lstrcmpiW (lpString1=".ai", lpString2="cab") returned -1 [0052.442] lstrlenW (lpString=".ai3") returned 4 [0052.442] lstrcmpiW (lpString1=".ai3", lpString2=".cab") returned -1 [0052.442] lstrlenW (lpString=".ai4") returned 4 [0052.442] lstrcmpiW (lpString1=".ai4", lpString2=".cab") returned -1 [0052.442] lstrlenW (lpString=".ai5") returned 4 [0052.442] lstrcmpiW (lpString1=".ai5", lpString2=".cab") returned -1 [0052.442] lstrlenW (lpString=".ai6") returned 4 [0052.442] lstrcmpiW (lpString1=".ai6", lpString2=".cab") returned -1 [0052.442] lstrlenW (lpString=".ai7") returned 4 [0052.442] lstrcmpiW (lpString1=".ai7", lpString2=".cab") returned -1 [0052.442] lstrlenW (lpString=".ai8") returned 4 [0052.442] lstrcmpiW (lpString1=".ai8", lpString2=".cab") returned -1 [0052.442] lstrlenW (lpString=".anim") returned 5 [0052.442] lstrcmpiW (lpString1=".anim", lpString2="f.cab") returned -1 [0052.442] lstrlenW (lpString=".arw") returned 4 [0052.442] lstrcmpiW (lpString1=".arw", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".as") returned 3 [0052.443] lstrcmpiW (lpString1=".as", lpString2="cab") returned -1 [0052.443] lstrlenW (lpString=".asa") returned 4 [0052.443] lstrcmpiW (lpString1=".asa", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".asc") returned 4 [0052.443] lstrcmpiW (lpString1=".asc", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".ascx") returned 5 [0052.443] lstrcmpiW (lpString1=".ascx", lpString2="f.cab") returned -1 [0052.443] lstrlenW (lpString=".asm") returned 4 [0052.443] lstrcmpiW (lpString1=".asm", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".asmx") returned 5 [0052.443] lstrcmpiW (lpString1=".asmx", lpString2="f.cab") returned -1 [0052.443] lstrlenW (lpString=".asp") returned 4 [0052.443] lstrcmpiW (lpString1=".asp", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".aspx") returned 5 [0052.443] lstrcmpiW (lpString1=".aspx", lpString2="f.cab") returned -1 [0052.443] lstrlenW (lpString=".asr") returned 4 [0052.443] lstrcmpiW (lpString1=".asr", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".asx") returned 4 [0052.443] lstrcmpiW (lpString1=".asx", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".avi") returned 4 [0052.443] lstrcmpiW (lpString1=".avi", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".avs") returned 4 [0052.443] lstrcmpiW (lpString1=".avs", lpString2=".cab") returned -1 [0052.443] lstrlenW (lpString=".backup") returned 7 [0052.443] lstrcmpiW (lpString1=".backup", lpString2="oof.cab") returned -1 [0052.444] lstrlenW (lpString=".bak") returned 4 [0052.444] lstrcmpiW (lpString1=".bak", lpString2=".cab") returned -1 [0052.444] lstrlenW (lpString=".bay") returned 4 [0052.444] lstrcmpiW (lpString1=".bay", lpString2=".cab") returned -1 [0052.444] lstrlenW (lpString=".bd") returned 3 [0052.444] lstrcmpiW (lpString1=".bd", lpString2="cab") returned -1 [0052.444] lstrlenW (lpString=".bin") returned 4 [0052.444] lstrcmpiW (lpString1=".bin", lpString2=".cab") returned -1 [0052.444] lstrlenW (lpString=".bmp") returned 4 [0052.444] lstrcmpiW (lpString1=".bmp", lpString2=".cab") returned -1 [0052.444] lstrlenW (lpString=".bz2") returned 4 [0052.444] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.444] lstrlenW (lpString=".c") returned 2 [0052.444] lstrcmpiW (lpString1=".c", lpString2="ab") returned -1 [0052.444] lstrlenW (lpString=".cdr") returned 4 [0052.444] lstrcmpiW (lpString1=".cdr", lpString2=".cab") returned 1 [0052.444] lstrlenW (lpString=".cer") returned 4 [0052.444] lstrcmpiW (lpString1=".cer", lpString2=".cab") returned 1 [0052.444] lstrlenW (lpString=".cf") returned 3 [0052.444] lstrcmpiW (lpString1=".cf", lpString2="cab") returned -1 [0052.444] lstrlenW (lpString=".cfc") returned 4 [0052.444] lstrcmpiW (lpString1=".cfc", lpString2=".cab") returned 1 [0052.444] lstrlenW (lpString=".cfm") returned 4 [0052.444] lstrcmpiW (lpString1=".cfm", lpString2=".cab") returned 1 [0052.445] lstrlenW (lpString=".cfml") returned 5 [0052.445] lstrcmpiW (lpString1=".cfml", lpString2="f.cab") returned -1 [0052.445] lstrlenW (lpString=".cfu") returned 4 [0052.445] lstrcmpiW (lpString1=".cfu", lpString2=".cab") returned 1 [0052.445] lstrlenW (lpString=".chm") returned 4 [0052.445] lstrcmpiW (lpString1=".chm", lpString2=".cab") returned 1 [0052.445] lstrlenW (lpString=".cin") returned 4 [0052.445] lstrcmpiW (lpString1=".cin", lpString2=".cab") returned 1 [0052.445] lstrlenW (lpString=".class") returned 6 [0052.445] lstrcmpiW (lpString1=".class", lpString2="of.cab") returned -1 [0052.445] lstrlenW (lpString=".clx") returned 4 [0052.445] lstrcmpiW (lpString1=".clx", lpString2=".cab") returned 1 [0052.445] lstrlenW (lpString=".config") returned 7 [0052.445] lstrcmpiW (lpString1=".config", lpString2="oof.cab") returned -1 [0052.445] lstrlenW (lpString=".cpp") returned 4 [0052.445] lstrcmpiW (lpString1=".cpp", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".cr2") returned 4 [0052.446] lstrcmpiW (lpString1=".cr2", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".crt") returned 4 [0052.446] lstrcmpiW (lpString1=".crt", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".crw") returned 4 [0052.446] lstrcmpiW (lpString1=".crw", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".cs") returned 3 [0052.446] lstrcmpiW (lpString1=".cs", lpString2="cab") returned -1 [0052.446] lstrlenW (lpString=".css") returned 4 [0052.446] lstrcmpiW (lpString1=".css", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".csv") returned 4 [0052.446] lstrcmpiW (lpString1=".csv", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".cub") returned 4 [0052.446] lstrcmpiW (lpString1=".cub", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".dae") returned 4 [0052.446] lstrcmpiW (lpString1=".dae", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".dat") returned 4 [0052.446] lstrcmpiW (lpString1=".dat", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".db") returned 3 [0052.446] lstrcmpiW (lpString1=".db", lpString2="cab") returned -1 [0052.446] lstrlenW (lpString=".dbf") returned 4 [0052.446] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".dbx") returned 4 [0052.446] lstrcmpiW (lpString1=".dbx", lpString2=".cab") returned 1 [0052.446] lstrlenW (lpString=".dc3") returned 4 [0052.447] lstrcmpiW (lpString1=".dc3", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".dcm") returned 4 [0052.447] lstrcmpiW (lpString1=".dcm", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".dcr") returned 4 [0052.447] lstrcmpiW (lpString1=".dcr", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".der") returned 4 [0052.447] lstrcmpiW (lpString1=".der", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".dib") returned 4 [0052.447] lstrcmpiW (lpString1=".dib", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".dic") returned 4 [0052.447] lstrcmpiW (lpString1=".dic", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".dif") returned 4 [0052.447] lstrcmpiW (lpString1=".dif", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".divx") returned 5 [0052.447] lstrcmpiW (lpString1=".divx", lpString2="f.cab") returned -1 [0052.447] lstrlenW (lpString=".djvu") returned 5 [0052.447] lstrcmpiW (lpString1=".djvu", lpString2="f.cab") returned -1 [0052.447] lstrlenW (lpString=".dng") returned 4 [0052.447] lstrcmpiW (lpString1=".dng", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".doc") returned 4 [0052.447] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.447] lstrlenW (lpString=".docm") returned 5 [0052.447] lstrcmpiW (lpString1=".docm", lpString2="f.cab") returned -1 [0052.447] lstrlenW (lpString=".docx") returned 5 [0052.448] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0052.448] lstrlenW (lpString=".dot") returned 4 [0052.448] lstrcmpiW (lpString1=".dot", lpString2=".cab") returned 1 [0052.448] lstrlenW (lpString=".dotm") returned 5 [0052.448] lstrcmpiW (lpString1=".dotm", lpString2="f.cab") returned -1 [0052.448] lstrlenW (lpString=".dotx") returned 5 [0052.448] lstrcmpiW (lpString1=".dotx", lpString2="f.cab") returned -1 [0052.448] lstrlenW (lpString=".dpx") returned 4 [0052.448] lstrcmpiW (lpString1=".dpx", lpString2=".cab") returned 1 [0052.448] lstrlenW (lpString=".dqy") returned 4 [0052.448] lstrcmpiW (lpString1=".dqy", lpString2=".cab") returned 1 [0052.448] lstrlenW (lpString=".dsn") returned 4 [0052.448] lstrcmpiW (lpString1=".dsn", lpString2=".cab") returned 1 [0052.448] lstrlenW (lpString=".dt") returned 3 [0052.448] lstrcmpiW (lpString1=".dt", lpString2="cab") returned -1 [0052.448] lstrlenW (lpString=".dtd") returned 4 [0052.448] lstrcmpiW (lpString1=".dtd", lpString2=".cab") returned 1 [0052.448] lstrlenW (lpString=".dwg") returned 4 [0052.448] lstrcmpiW (lpString1=".dwg", lpString2=".cab") returned 1 [0052.448] lstrlenW (lpString=".dwt") returned 4 [0052.448] lstrcmpiW (lpString1=".dwt", lpString2=".cab") returned 1 [0052.448] lstrlenW (lpString=".dx") returned 3 [0052.448] lstrcmpiW (lpString1=".dx", lpString2="cab") returned -1 [0052.449] lstrlenW (lpString=".dxf") returned 4 [0052.449] lstrcmpiW (lpString1=".dxf", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".edml") returned 5 [0052.449] lstrcmpiW (lpString1=".edml", lpString2="f.cab") returned -1 [0052.449] lstrlenW (lpString=".efd") returned 4 [0052.449] lstrcmpiW (lpString1=".efd", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".elf") returned 4 [0052.449] lstrcmpiW (lpString1=".elf", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".emf") returned 4 [0052.449] lstrcmpiW (lpString1=".emf", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".emz") returned 4 [0052.449] lstrcmpiW (lpString1=".emz", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".epf") returned 4 [0052.449] lstrcmpiW (lpString1=".epf", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".eps") returned 4 [0052.449] lstrcmpiW (lpString1=".eps", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".epsf") returned 5 [0052.449] lstrcmpiW (lpString1=".epsf", lpString2="f.cab") returned -1 [0052.449] lstrlenW (lpString=".epsp") returned 5 [0052.449] lstrcmpiW (lpString1=".epsp", lpString2="f.cab") returned -1 [0052.449] lstrlenW (lpString=".erf") returned 4 [0052.449] lstrcmpiW (lpString1=".erf", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".exr") returned 4 [0052.449] lstrcmpiW (lpString1=".exr", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".f4v") returned 4 [0052.449] lstrcmpiW (lpString1=".f4v", lpString2=".cab") returned 1 [0052.449] lstrlenW (lpString=".fido") returned 5 [0052.450] lstrcmpiW (lpString1=".fido", lpString2="f.cab") returned -1 [0052.450] lstrlenW (lpString=".flm") returned 4 [0052.450] lstrcmpiW (lpString1=".flm", lpString2=".cab") returned 1 [0052.450] lstrlenW (lpString=".flv") returned 4 [0052.450] lstrcmpiW (lpString1=".flv", lpString2=".cab") returned 1 [0052.450] lstrlenW (lpString=".frm") returned 4 [0052.450] lstrcmpiW (lpString1=".frm", lpString2=".cab") returned 1 [0052.450] lstrlenW (lpString=".fxg") returned 4 [0052.450] lstrcmpiW (lpString1=".fxg", lpString2=".cab") returned 1 [0052.450] lstrlenW (lpString=".geo") returned 4 [0052.450] lstrcmpiW (lpString1=".geo", lpString2=".cab") returned 1 [0052.450] lstrlenW (lpString=".gif") returned 4 [0052.450] lstrcmpiW (lpString1=".gif", lpString2=".cab") returned 1 [0052.450] lstrlenW (lpString=".grs") returned 4 [0052.450] lstrcmpiW (lpString1=".grs", lpString2=".cab") returned 1 [0052.450] lstrlenW (lpString=".gz") returned 3 [0052.450] lstrcmpiW (lpString1=".gz", lpString2="cab") returned -1 [0052.450] lstrlenW (lpString=".h") returned 2 [0052.450] lstrcmpiW (lpString1=".h", lpString2="ab") returned -1 [0052.450] lstrlenW (lpString=".hdr") returned 4 [0052.450] lstrcmpiW (lpString1=".hdr", lpString2=".cab") returned 1 [0052.450] lstrlenW (lpString=".hpp") returned 4 [0052.450] lstrcmpiW (lpString1=".hpp", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".hta") returned 4 [0052.451] lstrcmpiW (lpString1=".hta", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".htc") returned 4 [0052.451] lstrcmpiW (lpString1=".htc", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".htm") returned 4 [0052.451] lstrcmpiW (lpString1=".htm", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".html") returned 5 [0052.451] lstrcmpiW (lpString1=".html", lpString2="f.cab") returned -1 [0052.451] lstrlenW (lpString=".icb") returned 4 [0052.451] lstrcmpiW (lpString1=".icb", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".ics") returned 4 [0052.451] lstrcmpiW (lpString1=".ics", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".iff") returned 4 [0052.451] lstrcmpiW (lpString1=".iff", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".inc") returned 4 [0052.451] lstrcmpiW (lpString1=".inc", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".indd") returned 5 [0052.451] lstrcmpiW (lpString1=".indd", lpString2="f.cab") returned -1 [0052.451] lstrlenW (lpString=".ini") returned 4 [0052.451] lstrcmpiW (lpString1=".ini", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".iqy") returned 4 [0052.451] lstrcmpiW (lpString1=".iqy", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".j2c") returned 4 [0052.451] lstrcmpiW (lpString1=".j2c", lpString2=".cab") returned 1 [0052.451] lstrlenW (lpString=".j2k") returned 4 [0052.452] lstrcmpiW (lpString1=".j2k", lpString2=".cab") returned 1 [0052.452] lstrlenW (lpString=".java") returned 5 [0052.452] lstrcmpiW (lpString1=".java", lpString2="f.cab") returned -1 [0052.452] lstrlenW (lpString=".jp2") returned 4 [0052.452] lstrcmpiW (lpString1=".jp2", lpString2=".cab") returned 1 [0052.452] lstrlenW (lpString=".jpc") returned 4 [0052.452] lstrcmpiW (lpString1=".jpc", lpString2=".cab") returned 1 [0052.452] lstrlenW (lpString=".jpe") returned 4 [0052.452] lstrcmpiW (lpString1=".jpe", lpString2=".cab") returned 1 [0052.452] lstrlenW (lpString=".jpeg") returned 5 [0052.452] lstrcmpiW (lpString1=".jpeg", lpString2="f.cab") returned -1 [0052.452] lstrlenW (lpString=".jpf") returned 4 [0052.452] lstrcmpiW (lpString1=".jpf", lpString2=".cab") returned 1 [0052.452] lstrlenW (lpString=".jpg") returned 4 [0052.452] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.452] lstrlenW (lpString=".jpx") returned 4 [0052.452] lstrcmpiW (lpString1=".jpx", lpString2=".cab") returned 1 [0052.452] lstrlenW (lpString=".js") returned 3 [0052.453] lstrcmpiW (lpString1=".js", lpString2="cab") returned -1 [0052.453] lstrlenW (lpString=".jsf") returned 4 [0052.453] lstrcmpiW (lpString1=".jsf", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".json") returned 5 [0052.453] lstrcmpiW (lpString1=".json", lpString2="f.cab") returned -1 [0052.453] lstrlenW (lpString=".jsp") returned 4 [0052.453] lstrcmpiW (lpString1=".jsp", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".kdc") returned 4 [0052.453] lstrcmpiW (lpString1=".kdc", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".kmz") returned 4 [0052.453] lstrcmpiW (lpString1=".kmz", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".kwm") returned 4 [0052.453] lstrcmpiW (lpString1=".kwm", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".lasso") returned 6 [0052.453] lstrcmpiW (lpString1=".lasso", lpString2="of.cab") returned -1 [0052.453] lstrlenW (lpString=".lbi") returned 4 [0052.453] lstrcmpiW (lpString1=".lbi", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".lgf") returned 4 [0052.453] lstrcmpiW (lpString1=".lgf", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".lgp") returned 4 [0052.453] lstrcmpiW (lpString1=".lgp", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".log") returned 4 [0052.453] lstrcmpiW (lpString1=".log", lpString2=".cab") returned 1 [0052.453] lstrlenW (lpString=".m1v") returned 4 [0052.454] lstrcmpiW (lpString1=".m1v", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".m4a") returned 4 [0052.454] lstrcmpiW (lpString1=".m4a", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".m4v") returned 4 [0052.454] lstrcmpiW (lpString1=".m4v", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".max") returned 4 [0052.454] lstrcmpiW (lpString1=".max", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".md") returned 3 [0052.454] lstrcmpiW (lpString1=".md", lpString2="cab") returned -1 [0052.454] lstrlenW (lpString=".mda") returned 4 [0052.454] lstrcmpiW (lpString1=".mda", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".mdb") returned 4 [0052.454] lstrcmpiW (lpString1=".mdb", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".mde") returned 4 [0052.454] lstrcmpiW (lpString1=".mde", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".mdf") returned 4 [0052.454] lstrcmpiW (lpString1=".mdf", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".mdw") returned 4 [0052.454] lstrcmpiW (lpString1=".mdw", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".mef") returned 4 [0052.454] lstrcmpiW (lpString1=".mef", lpString2=".cab") returned 1 [0052.454] lstrlenW (lpString=".mft") returned 4 [0052.454] lstrcmpiW (lpString1=".mft", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mfw") returned 4 [0052.455] lstrcmpiW (lpString1=".mfw", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mht") returned 4 [0052.455] lstrcmpiW (lpString1=".mht", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mhtml") returned 6 [0052.455] lstrcmpiW (lpString1=".mhtml", lpString2="of.cab") returned -1 [0052.455] lstrlenW (lpString=".mka") returned 4 [0052.455] lstrcmpiW (lpString1=".mka", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mkidx") returned 6 [0052.455] lstrcmpiW (lpString1=".mkidx", lpString2="of.cab") returned -1 [0052.455] lstrlenW (lpString=".mkv") returned 4 [0052.455] lstrcmpiW (lpString1=".mkv", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mos") returned 4 [0052.455] lstrcmpiW (lpString1=".mos", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mov") returned 4 [0052.455] lstrcmpiW (lpString1=".mov", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mp3") returned 4 [0052.455] lstrcmpiW (lpString1=".mp3", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mp4") returned 4 [0052.455] lstrcmpiW (lpString1=".mp4", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mpeg") returned 5 [0052.455] lstrcmpiW (lpString1=".mpeg", lpString2="f.cab") returned -1 [0052.455] lstrlenW (lpString=".mpg") returned 4 [0052.455] lstrcmpiW (lpString1=".mpg", lpString2=".cab") returned 1 [0052.455] lstrlenW (lpString=".mpv") returned 4 [0052.456] lstrcmpiW (lpString1=".mpv", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".mrw") returned 4 [0052.456] lstrcmpiW (lpString1=".mrw", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".msg") returned 4 [0052.456] lstrcmpiW (lpString1=".msg", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".mxl") returned 4 [0052.456] lstrcmpiW (lpString1=".mxl", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".myd") returned 4 [0052.456] lstrcmpiW (lpString1=".myd", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".myi") returned 4 [0052.456] lstrcmpiW (lpString1=".myi", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".nef") returned 4 [0052.456] lstrcmpiW (lpString1=".nef", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".nrw") returned 4 [0052.456] lstrcmpiW (lpString1=".nrw", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".obj") returned 4 [0052.456] lstrcmpiW (lpString1=".obj", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".odb") returned 4 [0052.456] lstrcmpiW (lpString1=".odb", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".odc") returned 4 [0052.456] lstrcmpiW (lpString1=".odc", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".odm") returned 4 [0052.456] lstrcmpiW (lpString1=".odm", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".odp") returned 4 [0052.456] lstrcmpiW (lpString1=".odp", lpString2=".cab") returned 1 [0052.456] lstrlenW (lpString=".ods") returned 4 [0052.457] lstrcmpiW (lpString1=".ods", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".oft") returned 4 [0052.457] lstrcmpiW (lpString1=".oft", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".one") returned 4 [0052.457] lstrcmpiW (lpString1=".one", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".onepkg") returned 7 [0052.457] lstrcmpiW (lpString1=".onepkg", lpString2="oof.cab") returned -1 [0052.457] lstrlenW (lpString=".onetoc2") returned 8 [0052.457] lstrcmpiW (lpString1=".onetoc2", lpString2="roof.cab") returned -1 [0052.457] lstrlenW (lpString=".opt") returned 4 [0052.457] lstrcmpiW (lpString1=".opt", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".oqy") returned 4 [0052.457] lstrcmpiW (lpString1=".oqy", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".orf") returned 4 [0052.457] lstrcmpiW (lpString1=".orf", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".p12") returned 4 [0052.457] lstrcmpiW (lpString1=".p12", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".p7b") returned 4 [0052.457] lstrcmpiW (lpString1=".p7b", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".p7c") returned 4 [0052.457] lstrcmpiW (lpString1=".p7c", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".pam") returned 4 [0052.457] lstrcmpiW (lpString1=".pam", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".pbm") returned 4 [0052.457] lstrcmpiW (lpString1=".pbm", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".pct") returned 4 [0052.457] lstrcmpiW (lpString1=".pct", lpString2=".cab") returned 1 [0052.457] lstrlenW (lpString=".pcx") returned 4 [0052.457] lstrcmpiW (lpString1=".pcx", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pdd") returned 4 [0052.458] lstrcmpiW (lpString1=".pdd", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pdf") returned 4 [0052.458] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pdp") returned 4 [0052.458] lstrcmpiW (lpString1=".pdp", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pef") returned 4 [0052.458] lstrcmpiW (lpString1=".pef", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pem") returned 4 [0052.458] lstrcmpiW (lpString1=".pem", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pff") returned 4 [0052.458] lstrcmpiW (lpString1=".pff", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pfm") returned 4 [0052.458] lstrcmpiW (lpString1=".pfm", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pfx") returned 4 [0052.458] lstrcmpiW (lpString1=".pfx", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".pgm") returned 4 [0052.458] lstrcmpiW (lpString1=".pgm", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".php") returned 4 [0052.458] lstrcmpiW (lpString1=".php", lpString2=".cab") returned 1 [0052.458] lstrlenW (lpString=".php3") returned 5 [0052.458] lstrcmpiW (lpString1=".php3", lpString2="f.cab") returned -1 [0052.458] lstrlenW (lpString=".php4") returned 5 [0052.458] lstrcmpiW (lpString1=".php4", lpString2="f.cab") returned -1 [0052.458] lstrlenW (lpString=".php5") returned 5 [0052.458] lstrcmpiW (lpString1=".php5", lpString2="f.cab") returned -1 [0052.458] lstrlenW (lpString=".phtml") returned 6 [0052.458] lstrcmpiW (lpString1=".phtml", lpString2="of.cab") returned -1 [0052.458] lstrlenW (lpString=".pict") returned 5 [0052.458] lstrcmpiW (lpString1=".pict", lpString2="f.cab") returned -1 [0052.459] lstrlenW (lpString=".pl") returned 3 [0052.459] lstrcmpiW (lpString1=".pl", lpString2="cab") returned -1 [0052.459] lstrlenW (lpString=".pls") returned 4 [0052.459] lstrcmpiW (lpString1=".pls", lpString2=".cab") returned 1 [0052.459] lstrlenW (lpString=".pm") returned 3 [0052.459] lstrcmpiW (lpString1=".pm", lpString2="cab") returned -1 [0052.459] lstrlenW (lpString=".png") returned 4 [0052.459] lstrcmpiW (lpString1=".png", lpString2=".cab") returned 1 [0052.459] lstrlenW (lpString=".pnm") returned 4 [0052.459] lstrcmpiW (lpString1=".pnm", lpString2=".cab") returned 1 [0052.459] lstrlenW (lpString=".pot") returned 4 [0052.459] lstrcmpiW (lpString1=".pot", lpString2=".cab") returned 1 [0052.459] lstrlenW (lpString=".potm") returned 5 [0052.459] lstrcmpiW (lpString1=".potm", lpString2="f.cab") returned -1 [0052.459] lstrlenW (lpString=".potx") returned 5 [0052.459] lstrcmpiW (lpString1=".potx", lpString2="f.cab") returned -1 [0052.459] lstrlenW (lpString=".ppa") returned 4 [0052.459] lstrcmpiW (lpString1=".ppa", lpString2=".cab") returned 1 [0052.459] lstrlenW (lpString=".ppam") returned 5 [0052.459] lstrcmpiW (lpString1=".ppam", lpString2="f.cab") returned -1 [0052.459] lstrlenW (lpString=".ppm") returned 4 [0052.459] lstrcmpiW (lpString1=".ppm", lpString2=".cab") returned 1 [0052.459] lstrlenW (lpString=".pps") returned 4 [0052.459] lstrcmpiW (lpString1=".pps", lpString2=".cab") returned 1 [0052.459] lstrlenW (lpString=".ppsm") returned 5 [0052.459] lstrcmpiW (lpString1=".ppsm", lpString2="f.cab") returned -1 [0052.459] lstrlenW (lpString=".ppt") returned 4 [0052.459] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.459] lstrlenW (lpString=".pptm") returned 5 [0052.460] lstrcmpiW (lpString1=".pptm", lpString2="f.cab") returned -1 [0052.460] lstrlenW (lpString=".pptx") returned 5 [0052.460] lstrcmpiW (lpString1=".pptx", lpString2="f.cab") returned -1 [0052.460] lstrlenW (lpString=".prn") returned 4 [0052.460] lstrcmpiW (lpString1=".prn", lpString2=".cab") returned 1 [0052.460] lstrlenW (lpString=".ps") returned 3 [0052.460] lstrcmpiW (lpString1=".ps", lpString2="cab") returned -1 [0052.553] lstrlenW (lpString=".psb") returned 4 [0052.553] lstrcmpiW (lpString1=".psb", lpString2=".cab") returned 1 [0052.553] lstrlenW (lpString=".psd") returned 4 [0052.553] lstrcmpiW (lpString1=".psd", lpString2=".cab") returned 1 [0052.553] lstrlenW (lpString=".pst") returned 4 [0052.553] lstrcmpiW (lpString1=".pst", lpString2=".cab") returned 1 [0052.553] lstrlenW (lpString=".ptx") returned 4 [0052.554] lstrcmpiW (lpString1=".ptx", lpString2=".cab") returned 1 [0052.554] lstrlenW (lpString=".pub") returned 4 [0052.554] lstrcmpiW (lpString1=".pub", lpString2=".cab") returned 1 [0052.554] lstrlenW (lpString=".pwm") returned 4 [0052.554] lstrcmpiW (lpString1=".pwm", lpString2=".cab") returned 1 [0052.554] lstrlenW (lpString=".pxr") returned 4 [0052.554] lstrcmpiW (lpString1=".pxr", lpString2=".cab") returned 1 [0052.554] lstrlenW (lpString=".py") returned 3 [0052.554] lstrcmpiW (lpString1=".py", lpString2="cab") returned -1 [0052.554] lstrlenW (lpString=".qt") returned 3 [0052.554] lstrcmpiW (lpString1=".qt", lpString2="cab") returned -1 [0052.554] lstrlenW (lpString=".r3d") returned 4 [0052.554] lstrcmpiW (lpString1=".r3d", lpString2=".cab") returned 1 [0052.554] lstrlenW (lpString=".raf") returned 4 [0052.554] lstrcmpiW (lpString1=".raf", lpString2=".cab") returned 1 [0052.554] FindClose (in: hFindFile=0x6d5810 | out: hFindFile=0x6d5810) returned 1 [0052.554] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ee2068 | out: hHeap=0x5e0000) returned 1 [0052.554] FindNextFileW (in: hFindFile=0x6d57d0, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0052.555] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x3ee2068 [0052.555] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f330d8 [0052.566] FindNextFileW (in: hFindFile=0x3f330d8, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.566] FindNextFileW (in: hFindFile=0x3f330d8, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.567] FindClose (in: hFindFile=0x3f330d8 | out: hFindFile=0x3f330d8) returned 1 [0052.567] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ee2068 | out: hHeap=0x5e0000) returned 1 [0052.567] FindNextFileW (in: hFindFile=0x6d57d0, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0052.567] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x3ee2068 [0052.567] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f330d8 [0052.568] FindNextFileW (in: hFindFile=0x3f330d8, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.568] FindNextFileW (in: hFindFile=0x3f330d8, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.568] FindClose (in: hFindFile=0x3f330d8 | out: hFindFile=0x3f330d8) returned 1 [0052.568] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ee2068 | out: hHeap=0x5e0000) returned 1 [0052.568] FindNextFileW (in: hFindFile=0x6d57d0, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0052.568] FindClose (in: hFindFile=0x6d57d0 | out: hFindFile=0x6d57d0) returned 1 [0052.568] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3ec0048 | out: hHeap=0x5e0000) returned 1 [0052.568] FindNextFileW (in: hFindFile=0x65fda8, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0052.568] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x3ec0048 [0052.922] FindNextFileW (in: hFindFile=0x3f330d8, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.922] FindNextFileW (in: hFindFile=0x3f330d8, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0058.688] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0058.688] lstrcmpiW (lpString1=".3ds", lpString2=".htm") returned -1 [0058.688] lstrcmpiW (lpString1=".3fr", lpString2=".htm") returned -1 [0058.688] lstrcmpiW (lpString1=".3g2", lpString2=".htm") returned -1 [0058.688] lstrcmpiW (lpString1=".3gp", lpString2=".htm") returned -1 [0058.688] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0058.688] lstrcmpiW (lpString1=".accda", lpString2="rs.htm") returned -1 [0058.689] lstrcmpiW (lpString1=".accdb", lpString2="rs.htm") returned -1 [0058.689] lstrcmpiW (lpString1=".accdc", lpString2="rs.htm") returned -1 [0058.689] lstrcmpiW (lpString1=".accde", lpString2="rs.htm") returned -1 [0058.689] lstrcmpiW (lpString1=".accdt", lpString2="rs.htm") returned -1 [0058.689] lstrcmpiW (lpString1=".accdw", lpString2="rs.htm") returned -1 [0058.689] lstrcmpiW (lpString1=".adb", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".adp", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".ai", lpString2="htm") returned -1 [0058.689] lstrcmpiW (lpString1=".ai3", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".ai4", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".ai5", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".ai6", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".ai7", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".ai8", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".anim", lpString2="s.htm") returned -1 [0058.689] lstrcmpiW (lpString1=".arw", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".as", lpString2="htm") returned -1 [0058.689] lstrcmpiW (lpString1=".asa", lpString2=".htm") returned -1 [0058.689] lstrcmpiW (lpString1=".asc", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".ascx", lpString2="s.htm") returned -1 [0058.690] lstrcmpiW (lpString1=".asm", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".asmx", lpString2="s.htm") returned -1 [0058.690] lstrcmpiW (lpString1=".asp", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".aspx", lpString2="s.htm") returned -1 [0058.690] lstrcmpiW (lpString1=".asr", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".asx", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".avi", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".avs", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".backup", lpString2="ars.htm") returned -1 [0058.690] lstrcmpiW (lpString1=".bak", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".bay", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".bd", lpString2="htm") returned -1 [0058.690] lstrcmpiW (lpString1=".bin", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".bmp", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".c", lpString2="tm") returned -1 [0058.690] lstrcmpiW (lpString1=".cdr", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".cer", lpString2=".htm") returned -1 [0058.690] lstrcmpiW (lpString1=".cf", lpString2="htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cfc", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cfm", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cfml", lpString2="s.htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cfu", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".chm", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cin", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".class", lpString2="rs.htm") returned -1 [0058.691] lstrcmpiW (lpString1=".clx", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".config", lpString2="ars.htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cpp", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cr2", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".crt", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".crw", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cs", lpString2="htm") returned -1 [0058.691] lstrcmpiW (lpString1=".css", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".csv", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".cub", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".dae", lpString2=".htm") returned -1 [0058.691] lstrcmpiW (lpString1=".dat", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".db", lpString2="htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dbx", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dc3", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dcm", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dcr", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".der", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dib", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dic", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dif", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".divx", lpString2="s.htm") returned -1 [0058.692] lstrcmpiW (lpString1=".djvu", lpString2="s.htm") returned -1 [0058.692] lstrcmpiW (lpString1=".dng", lpString2=".htm") returned -1 [0058.692] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".docm", lpString2="s.htm") returned -1 [0058.693] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dot", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dotm", lpString2="s.htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dotx", lpString2="s.htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dpx", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dqy", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dsn", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dt", lpString2="htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dtd", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dwg", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dwt", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dx", lpString2="htm") returned -1 [0058.693] lstrcmpiW (lpString1=".dxf", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".edml", lpString2="s.htm") returned -1 [0058.693] lstrcmpiW (lpString1=".efd", lpString2=".htm") returned -1 [0058.693] lstrcmpiW (lpString1=".elf", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".emf", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".emz", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".epf", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".eps", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".epsf", lpString2="s.htm") returned -1 [0058.694] lstrcmpiW (lpString1=".epsp", lpString2="s.htm") returned -1 [0058.694] lstrcmpiW (lpString1=".erf", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".exr", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".f4v", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".fido", lpString2="s.htm") returned -1 [0058.694] lstrcmpiW (lpString1=".flm", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".flv", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".frm", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".fxg", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".geo", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".gif", lpString2=".htm") returned -1 [0058.694] lstrcmpiW (lpString1=".grs", lpString2=".htm") returned -1 [0058.695] lstrcmpiW (lpString1=".gz", lpString2="htm") returned -1 [0058.695] lstrcmpiW (lpString1=".h", lpString2="tm") returned -1 [0058.695] lstrcmpiW (lpString1=".hdr", lpString2=".htm") returned -1 [0058.695] lstrcmpiW (lpString1=".hpp", lpString2=".htm") returned -1 [0058.695] lstrcmpiW (lpString1=".hta", lpString2=".htm") returned -1 [0058.695] lstrcmpiW (lpString1=".htc", lpString2=".htm") returned -1 [0058.695] lstrcmpiW (lpString1=".htm", lpString2=".htm") returned 0 [0058.695] FindNextFileW (in: hFindFile=0x3f33298, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0058.696] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".accda", lpString2="rs.jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".accdb", lpString2="rs.jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".accdc", lpString2="rs.jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".accde", lpString2="rs.jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".accdt", lpString2="rs.jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".accdw", lpString2="rs.jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0058.696] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".anim", lpString2="s.jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0058.697] lstrcmpiW (lpString1=".ascx", lpString2="s.jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".asmx", lpString2="s.jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".aspx", lpString2="s.jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".backup", lpString2="ars.jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0058.698] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0058.698] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cfml", lpString2="s.jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".class", lpString2="rs.jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".config", lpString2="ars.jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0058.699] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".divx", lpString2="s.jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".djvu", lpString2="s.jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0058.700] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".docm", lpString2="s.jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dotm", lpString2="s.jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dotx", lpString2="s.jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".edml", lpString2="s.jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0058.701] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".epsf", lpString2="s.jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".epsp", lpString2="s.jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".fido", lpString2="s.jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0058.702] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0058.702] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".html", lpString2="s.jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".indd", lpString2="s.jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".iqy", lpString2=".jpg") returned -1 [0058.703] lstrcmpiW (lpString1=".j2c", lpString2=".jpg") returned -1 Thread: id = 21 os_tid = 0xa8c Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x45784000" os_pid = "0xa28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa14" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xa2c [0049.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fa30 | out: lpSystemTimeAsFileTime=0x14fa30*(dwLowDateTime=0x1c6adb00, dwHighDateTime=0x1d5157a)) [0049.916] GetCurrentProcessId () returned 0xa28 [0049.916] GetCurrentThreadId () returned 0xa2c [0049.916] GetTickCount () returned 0x1a717 [0049.916] QueryPerformanceCounter (in: lpPerformanceCount=0x14fa38 | out: lpPerformanceCount=0x14fa38*=16941910171) returned 1 [0049.917] GetModuleHandleW (lpModuleName=0x0) returned 0x49d40000 [0049.917] __set_app_type (_Type=0x1) [0049.917] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49d67810) returned 0x0 [0050.014] __getmainargs (in: _Argc=0x49d8a608, _Argv=0x49d8a618, _Env=0x49d8a610, _DoWildCard=0, _StartInfo=0x49d6e0f4 | out: _Argc=0x49d8a608, _Argv=0x49d8a618, _Env=0x49d8a610) returned 0 [0050.014] GetCurrentThreadId () returned 0xa2c [0050.014] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa2c) returned 0x3c [0050.015] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0050.016] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0050.016] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0050.016] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.016] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f9c8 | out: phkResult=0x14f9c8*=0x0) returned 0x2 [0050.016] VirtualQuery (in: lpAddress=0x14f9b0, lpBuffer=0x14f930, dwLength=0x30 | out: lpBuffer=0x14f930*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.016] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f930, dwLength=0x30 | out: lpBuffer=0x14f930*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.016] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f930, dwLength=0x30 | out: lpBuffer=0x14f930*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.016] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14f930, dwLength=0x30 | out: lpBuffer=0x14f930*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0050.016] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f930, dwLength=0x30 | out: lpBuffer=0x14f930*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0050.016] GetConsoleOutputCP () returned 0x1b5 [0050.016] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d7bfe0 | out: lpCPInfo=0x49d7bfe0) returned 1 [0050.017] SetConsoleCtrlHandler (HandlerRoutine=0x49d63184, Add=1) returned 1 [0050.017] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.017] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0050.017] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.017] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49d6e194 | out: lpMode=0x49d6e194) returned 0 [0050.017] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.017] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49d6e198 | out: lpMode=0x49d6e198) returned 0 [0050.017] GetEnvironmentStringsW () returned 0x1e8a60* [0050.017] GetProcessHeap () returned 0x1d0000 [0050.017] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xa7c) returned 0x1e94f0 [0050.017] FreeEnvironmentStringsW (penv=0x1e8a60) returned 1 [0050.018] GetProcessHeap () returned 0x1d0000 [0050.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1e88e0 [0050.018] GetEnvironmentStringsW () returned 0x1e8a60* [0050.018] GetProcessHeap () returned 0x1d0000 [0050.018] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xa7c) returned 0x1e9f80 [0050.018] FreeEnvironmentStringsW (penv=0x1e8a60) returned 1 [0050.018] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e888 | out: phkResult=0x14e888*=0x44) returned 0x0 [0050.018] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x0, lpData=0x14e8a0*=0x18, lpcbData=0x14e884*=0x1000) returned 0x2 [0050.018] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x4, lpData=0x14e8a0*=0x1, lpcbData=0x14e884*=0x4) returned 0x0 [0050.018] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x0, lpData=0x14e8a0*=0x1, lpcbData=0x14e884*=0x1000) returned 0x2 [0050.018] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x4, lpData=0x14e8a0*=0x0, lpcbData=0x14e884*=0x4) returned 0x0 [0050.018] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x4, lpData=0x14e8a0*=0x40, lpcbData=0x14e884*=0x4) returned 0x0 [0050.018] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x4, lpData=0x14e8a0*=0x40, lpcbData=0x14e884*=0x4) returned 0x0 [0050.018] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x0, lpData=0x14e8a0*=0x40, lpcbData=0x14e884*=0x1000) returned 0x2 [0050.018] RegCloseKey (hKey=0x44) returned 0x0 [0050.018] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e888 | out: phkResult=0x14e888*=0x44) returned 0x0 [0050.018] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x0, lpData=0x14e8a0*=0x40, lpcbData=0x14e884*=0x1000) returned 0x2 [0050.019] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x4, lpData=0x14e8a0*=0x1, lpcbData=0x14e884*=0x4) returned 0x0 [0050.019] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x0, lpData=0x14e8a0*=0x1, lpcbData=0x14e884*=0x1000) returned 0x2 [0050.019] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x4, lpData=0x14e8a0*=0x0, lpcbData=0x14e884*=0x4) returned 0x0 [0050.019] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x4, lpData=0x14e8a0*=0x9, lpcbData=0x14e884*=0x4) returned 0x0 [0050.019] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x4, lpData=0x14e8a0*=0x9, lpcbData=0x14e884*=0x4) returned 0x0 [0050.019] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e880, lpData=0x14e8a0, lpcbData=0x14e884*=0x1000 | out: lpType=0x14e880*=0x0, lpData=0x14e8a0*=0x9, lpcbData=0x14e884*=0x1000) returned 0x2 [0050.019] RegCloseKey (hKey=0x44) returned 0x0 [0050.019] time (in: timer=0x0 | out: timer=0x0) returned 0x5ced6ea4 [0050.019] srand (_Seed=0x5ced6ea4) [0050.019] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0050.019] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0050.019] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d7c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0050.019] GetProcessHeap () returned 0x1d0000 [0050.019] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x218) returned 0x1eaa10 [0050.019] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1eaa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0050.020] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0050.020] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0050.020] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0050.020] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0050.020] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0050.020] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0050.020] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0050.020] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0050.020] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0050.020] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0050.020] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0050.020] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0050.020] GetProcessHeap () returned 0x1d0000 [0050.020] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e94f0 | out: hHeap=0x1d0000) returned 1 [0050.020] GetEnvironmentStringsW () returned 0x1e8a60* [0050.020] GetProcessHeap () returned 0x1d0000 [0050.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xa94) returned 0x1eac30 [0050.020] FreeEnvironmentStringsW (penv=0x1e8a60) returned 1 [0050.020] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0050.021] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0050.021] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0050.021] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0050.021] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0050.021] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0050.021] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0050.021] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0050.021] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0050.021] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0050.021] GetProcessHeap () returned 0x1d0000 [0050.021] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5c) returned 0x1eb6d0 [0050.021] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f690 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0050.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f690, lpFilePart=0x14f670 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f670*="Desktop") returned 0x25 [0050.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0050.021] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f3a0 | out: lpFindFileData=0x14f3a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x1eb740 [0050.021] FindClose (in: hFindFile=0x1eb740 | out: hFindFile=0x1eb740) returned 1 [0050.022] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x14f3a0 | out: lpFindFileData=0x14f3a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x1eb740 [0050.022] FindClose (in: hFindFile=0x1eb740 | out: hFindFile=0x1eb740) returned 1 [0050.022] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0050.022] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x14f3a0 | out: lpFindFileData=0x14f3a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x14ce9d00, ftLastAccessTime.dwHighDateTime=0x1d5157a, ftLastWriteTime.dwLowDateTime=0x14ce9d00, ftLastWriteTime.dwHighDateTime=0x1d5157a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x1eb740 [0050.022] FindClose (in: hFindFile=0x1eb740 | out: hFindFile=0x1eb740) returned 1 [0050.022] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0050.022] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0050.022] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0050.022] GetProcessHeap () returned 0x1d0000 [0050.022] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eac30 | out: hHeap=0x1d0000) returned 1 [0050.022] GetEnvironmentStringsW () returned 0x1eb740* [0050.023] GetProcessHeap () returned 0x1d0000 [0050.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xae8) returned 0x1ec230 [0050.023] FreeEnvironmentStringsW (penv=0x1eb740) returned 1 [0050.023] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d7c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0050.023] GetProcessHeap () returned 0x1d0000 [0050.023] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb6d0 | out: hHeap=0x1d0000) returned 1 [0050.023] GetProcessHeap () returned 0x1d0000 [0050.023] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x4016) returned 0x1ecd20 [0050.023] GetProcessHeap () returned 0x1d0000 [0050.023] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd20 | out: hHeap=0x1d0000) returned 1 [0050.023] GetConsoleOutputCP () returned 0x1b5 [0050.024] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d7bfe0 | out: lpCPInfo=0x49d7bfe0) returned 1 [0050.024] GetUserDefaultLCID () returned 0x409 [0050.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49d77b50, cchData=8 | out: lpLCData=":") returned 2 [0050.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f7a0, cchData=128 | out: lpLCData="0") returned 2 [0050.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f7a0, cchData=128 | out: lpLCData="0") returned 2 [0050.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f7a0, cchData=128 | out: lpLCData="1") returned 2 [0050.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49d8a740, cchData=8 | out: lpLCData="/") returned 2 [0050.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49d8a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0050.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49d8a460, cchData=32 | out: lpLCData="Tue") returned 4 [0050.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49d8a420, cchData=32 | out: lpLCData="Wed") returned 4 [0050.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49d8a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0050.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49d8a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0050.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49d8a360, cchData=32 | out: lpLCData="Sat") returned 4 [0050.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49d8a700, cchData=32 | out: lpLCData="Sun") returned 4 [0050.025] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49d77b40, cchData=8 | out: lpLCData=".") returned 2 [0050.025] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49d8a4e0, cchData=8 | out: lpLCData=",") returned 2 [0050.025] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0050.026] GetProcessHeap () returned 0x1d0000 [0050.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20c) returned 0x1e95c0 [0050.026] GetConsoleTitleW (in: lpConsoleTitle=0x1e95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0050.026] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.026] GetFileType (hFile=0xf4) returned 0x3 [0050.026] BrandingFormatString () returned 0x1e97e0 [0050.056] GetVersion () returned 0x1db10106 [0050.056] _vsnwprintf (in: _Buffer=0x14f910, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x14f8a8 | out: _Buffer="6.1.7601") returned 8 [0050.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.056] GetFileType (hFile=0xf4) returned 0x3 [0050.056] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49d86340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0050.056] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49d86340, nSize=0x2000, Arguments=0x14f8b0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0050.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.056] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0050.056] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14f838, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f838*=0x24, lpOverlapped=0x0) returned 1 [0050.056] _vsnwprintf (in: _Buffer=0x49d86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f8d8 | out: _Buffer="\r\n") returned 2 [0050.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.056] GetFileType (hFile=0xf4) returned 0x3 [0050.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.056] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0050.056] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f8a8, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f8a8*=0x2, lpOverlapped=0x0) returned 1 [0050.057] _vsnwprintf (in: _Buffer=0x49d86340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x14f8d8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0050.057] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.057] GetFileType (hFile=0xf4) returned 0x3 [0050.057] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.057] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0050.057] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x14f8a8, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f8a8*=0x3f, lpOverlapped=0x0) returned 1 [0050.057] _vsnwprintf (in: _Buffer=0x49d86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f8d8 | out: _Buffer="\r\n") returned 2 [0050.057] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.057] GetFileType (hFile=0xf4) returned 0x3 [0050.057] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.057] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0050.057] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f8a8, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f8a8*=0x2, lpOverlapped=0x0) returned 1 [0050.057] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0050.057] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0050.057] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0050.057] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0050.057] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.057] GetFileType (hFile=0xe8) returned 0x3 [0050.058] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0050.058] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x14f700 | out: TokenHandle=0x14f700*=0x0) returned 0xc000007c [0050.059] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x14f700 | out: TokenHandle=0x14f700*=0x50) returned 0x0 [0050.059] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x14f710, TokenInformationLength=0x4, ReturnLength=0x14f718 | out: TokenInformation=0x14f710, ReturnLength=0x14f718) returned 0x0 [0050.059] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x14f718, TokenInformationLength=0x4, ReturnLength=0x14f710 | out: TokenInformation=0x14f718, ReturnLength=0x14f710) returned 0x0 [0050.059] NtClose (Handle=0x50) returned 0x0 [0050.059] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x14f6e0, nSize=0x0, Arguments=0x14f6e8 | out: lpBuffer="\x97e0\x1e") returned 0xf [0050.059] GetProcessHeap () returned 0x1d0000 [0050.059] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x218) returned 0x1d1ab0 [0050.059] GetConsoleTitleW (in: lpConsoleTitle=0x14f730, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0050.060] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0050.060] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0050.061] GetProcessHeap () returned 0x1d0000 [0050.061] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1ab0 | out: hHeap=0x1d0000) returned 1 [0050.061] LocalFree (hMem=0x1e97e0) returned 0x0 [0050.061] GetProcessHeap () returned 0x1d0000 [0050.061] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eaa10 | out: hHeap=0x1d0000) returned 1 [0050.061] _vsnwprintf (in: _Buffer=0x49d86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f418 | out: _Buffer="\r\n") returned 2 [0050.061] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.061] GetFileType (hFile=0xf4) returned 0x3 [0050.061] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.061] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0050.061] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f3e8, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f3e8*=0x2, lpOverlapped=0x0) returned 1 [0050.061] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0050.061] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d7c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0050.061] _vsnwprintf (in: _Buffer=0x49d6eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f428 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0050.062] _vsnwprintf (in: _Buffer=0x49d6ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f428 | out: _Buffer=">") returned 1 [0050.062] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.062] GetFileType (hFile=0xf4) returned 0x3 [0050.062] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.062] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0050.062] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f418, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f418*=0x26, lpOverlapped=0x0) returned 1 [0050.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.062] GetFileType (hFile=0xe8) returned 0x3 [0050.062] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.062] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.062] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0050.063] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.063] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.063] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0050.063] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.063] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.063] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0050.063] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.063] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.063] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0050.063] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.063] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.064] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0050.064] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.064] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.064] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0050.064] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.064] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.064] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0050.064] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.064] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.064] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0050.064] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.064] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.064] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0050.064] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.064] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.064] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0050.065] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.065] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.065] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0050.065] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.065] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.065] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0050.065] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.065] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.065] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0050.065] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.065] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.065] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0050.065] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.065] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.065] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0050.065] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.065] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.065] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0050.065] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.066] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.066] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0050.066] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.066] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.066] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0050.066] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.066] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.066] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0050.066] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.066] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.066] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0050.066] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.066] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.066] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0050.066] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.066] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.066] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0050.066] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.066] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.067] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0050.067] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.067] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.067] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0050.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0050.067] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.067] GetFileType (hFile=0xe8) returned 0x3 [0050.067] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.067] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.067] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.067] GetFileType (hFile=0xf4) returned 0x3 [0050.067] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.068] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0050.068] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x14f6f8, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f6f8*=0x18, lpOverlapped=0x0) returned 1 [0050.068] GetProcessHeap () returned 0x1d0000 [0050.068] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x4012) returned 0x1ecd20 [0050.068] GetProcessHeap () returned 0x1d0000 [0050.068] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd20 | out: hHeap=0x1d0000) returned 1 [0050.068] _wcsicmp (_String1="mode", _String2=")") returned 68 [0050.068] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0050.068] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0050.068] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0050.068] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0050.068] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0050.068] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0050.068] GetProcessHeap () returned 0x1d0000 [0050.068] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xb0) returned 0x1e97e0 [0050.068] GetProcessHeap () returned 0x1d0000 [0050.068] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1a) returned 0x1e4610 [0050.069] GetProcessHeap () returned 0x1d0000 [0050.069] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x38) returned 0x1e6510 [0050.070] GetConsoleOutputCP () returned 0x1b5 [0050.070] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d7bfe0 | out: lpCPInfo=0x49d7bfe0) returned 1 [0050.070] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0050.070] GetConsoleTitleW (in: lpConsoleTitle=0x14f6b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0050.070] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0050.070] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0050.070] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0050.070] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0050.070] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0050.070] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0050.070] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0050.070] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0050.071] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0050.071] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0050.071] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0050.071] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0050.071] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0050.071] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0050.071] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0050.071] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0050.071] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0050.071] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0050.071] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0050.071] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0050.071] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0050.071] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0050.071] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0050.071] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0050.071] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0050.071] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0050.071] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0050.071] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0050.071] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0050.071] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0050.071] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0050.071] _wcsicmp (_String1="mode", _String2="START") returned -6 [0050.071] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0050.071] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0050.071] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0050.071] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0050.071] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0050.071] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0050.071] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0050.071] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0050.071] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0050.071] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0050.071] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0050.071] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0050.071] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0050.072] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0050.072] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0050.072] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0050.072] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0050.072] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0050.072] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0050.072] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0050.072] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0050.072] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0050.072] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0050.072] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0050.072] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0050.072] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0050.072] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0050.072] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0050.072] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0050.072] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0050.072] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0050.072] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0050.072] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0050.072] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0050.072] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0050.072] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0050.072] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0050.072] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0050.072] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0050.072] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0050.072] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0050.072] _wcsicmp (_String1="mode", _String2="START") returned -6 [0050.072] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0050.072] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0050.072] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0050.072] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0050.072] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0050.072] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0050.072] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0050.072] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0050.072] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0050.073] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0050.073] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0050.073] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0050.073] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0050.073] GetProcessHeap () returned 0x1d0000 [0050.073] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x218) returned 0x1d1ab0 [0050.073] GetProcessHeap () returned 0x1d0000 [0050.073] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x42) returned 0x1e98a0 [0050.073] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0050.073] GetProcessHeap () returned 0x1d0000 [0050.073] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x420) returned 0x1e9a80 [0050.073] SetErrorMode (uMode=0x0) returned 0x0 [0050.073] SetErrorMode (uMode=0x1) returned 0x0 [0050.074] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1e9a90, lpFilePart=0x14ef40 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14ef40*="Desktop") returned 0x25 [0050.074] SetErrorMode (uMode=0x0) returned 0x1 [0050.074] GetProcessHeap () returned 0x1d0000 [0050.074] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e9a80, Size=0x66) returned 0x1e9a80 [0050.074] GetProcessHeap () returned 0x1d0000 [0050.074] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e9a80) returned 0x66 [0050.074] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0050.074] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0050.074] GetProcessHeap () returned 0x1d0000 [0050.074] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x128) returned 0x1d1cd0 [0050.074] GetProcessHeap () returned 0x1d0000 [0050.074] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x240) returned 0x1e9b00 [0050.080] GetProcessHeap () returned 0x1d0000 [0050.080] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e9b00, Size=0x12a) returned 0x1e9b00 [0050.080] GetProcessHeap () returned 0x1d0000 [0050.080] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e9b00) returned 0x12a [0050.080] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0050.080] GetProcessHeap () returned 0x1d0000 [0050.080] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xe8) returned 0x1e5b70 [0050.080] GetProcessHeap () returned 0x1d0000 [0050.080] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e5b70, Size=0x7e) returned 0x1e5b70 [0050.080] GetProcessHeap () returned 0x1d0000 [0050.080] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b70) returned 0x7e [0050.082] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.082] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0xffffffffffffffff [0050.082] GetLastError () returned 0x2 [0050.082] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0xffffffffffffffff [0050.082] GetLastError () returned 0x2 [0050.082] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.082] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0x1e5c00 [0050.082] GetProcessHeap () returned 0x1d0000 [0050.083] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x1e4640 [0050.083] FindClose (in: hFindFile=0x1e5c00 | out: hFindFile=0x1e5c00) returned 1 [0050.083] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0x1e5c00 [0050.083] GetProcessHeap () returned 0x1d0000 [0050.083] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e4640, Size=0x8) returned 0x1e98f0 [0050.083] FindClose (in: hFindFile=0x1e5c00 | out: hFindFile=0x1e5c00) returned 1 [0050.083] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0050.083] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0050.083] GetConsoleTitleW (in: lpConsoleTitle=0x14f200, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0050.083] GetProcessHeap () returned 0x1d0000 [0050.083] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x21c) returned 0x1e9c40 [0050.083] GetConsoleTitleW (in: lpConsoleTitle=0x1e9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0050.083] GetProcessHeap () returned 0x1d0000 [0050.084] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e9c40, Size=0xa8) returned 0x1e9c40 [0050.084] GetProcessHeap () returned 0x1d0000 [0050.084] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e9c40) returned 0xa8 [0050.084] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0050.084] GetProcessHeap () returned 0x1d0000 [0050.084] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e9c40 | out: hHeap=0x1d0000) returned 1 [0050.084] InitializeProcThreadAttributeList (in: lpAttributeList=0x14efb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ef78 | out: lpAttributeList=0x14efb8, lpSize=0x14ef78) returned 1 [0050.084] UpdateProcThreadAttribute (in: lpAttributeList=0x14efb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ef68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14efb8, lpPreviousValue=0x0) returned 1 [0050.084] GetStartupInfoW (in: lpStartupInfo=0x14f0d0 | out: lpStartupInfo=0x14f0d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0050.084] GetProcessHeap () returned 0x1d0000 [0050.084] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1e4640 [0050.084] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0050.084] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0050.085] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0050.086] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0050.086] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0050.086] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0050.086] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0050.086] GetProcessHeap () returned 0x1d0000 [0050.086] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e4640 | out: hHeap=0x1d0000) returned 1 [0050.086] GetProcessHeap () returned 0x1d0000 [0050.086] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x12) returned 0x1e8900 [0050.086] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14eff0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14efa0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x14efa0*(hProcess=0x54, hThread=0x50, dwProcessId=0xa54, dwThreadId=0xa58)) returned 1 [0050.545] CloseHandle (hObject=0x50) returned 1 [0050.545] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0050.545] GetProcessHeap () returned 0x1d0000 [0050.546] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec230 | out: hHeap=0x1d0000) returned 1 [0050.546] GetEnvironmentStringsW () returned 0x1eaa10* [0050.546] GetProcessHeap () returned 0x1d0000 [0050.546] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xae8) returned 0x1eb500 [0050.546] FreeEnvironmentStringsW (penv=0x1eaa10) returned 1 [0050.546] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0050.546] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0050.546] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e8a8, ReturnLength=0x0) returned 0x0 [0050.546] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffde000, lpBuffer=0x14e8e0, nSize=0x380, lpNumberOfBytesRead=0x14e8a0 | out: lpBuffer=0x14e8e0*, lpNumberOfBytesRead=0x14e8a0*=0x380) returned 1 [0050.547] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0053.106] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14eee8 | out: lpExitCode=0x14eee8*=0x0) returned 1 [0053.106] CloseHandle (hObject=0x54) returned 1 [0053.106] _vsnwprintf (in: _Buffer=0x14f158, _BufferCount=0x13, _Format="%08X", _ArgList=0x14eef8 | out: _Buffer="00000000") returned 8 [0053.106] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0053.106] GetProcessHeap () returned 0x1d0000 [0053.106] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb500 | out: hHeap=0x1d0000) returned 1 [0053.106] GetEnvironmentStringsW () returned 0x1eaa10* [0053.106] GetProcessHeap () returned 0x1d0000 [0053.106] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xb0e) returned 0x1eeb10 [0053.106] FreeEnvironmentStringsW (penv=0x1eaa10) returned 1 [0053.106] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0053.106] GetProcessHeap () returned 0x1d0000 [0053.106] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eeb10 | out: hHeap=0x1d0000) returned 1 [0053.106] GetEnvironmentStringsW () returned 0x1eaa10* [0053.106] GetProcessHeap () returned 0x1d0000 [0053.106] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xb0e) returned 0x1eeb10 [0053.107] FreeEnvironmentStringsW (penv=0x1eaa10) returned 1 [0053.107] GetProcessHeap () returned 0x1d0000 [0053.107] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e8900 | out: hHeap=0x1d0000) returned 1 [0053.107] DeleteProcThreadAttributeList (in: lpAttributeList=0x14efb8 | out: lpAttributeList=0x14efb8) [0053.522] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0053.522] _get_osfhandle (_FileHandle=1) returned 0xf4 [0053.522] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0053.522] _get_osfhandle (_FileHandle=1) returned 0xf4 [0053.523] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49d6e194 | out: lpMode=0x49d6e194) returned 0 [0053.523] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.523] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49d6e198 | out: lpMode=0x49d6e198) returned 0 [0053.523] GetConsoleOutputCP () returned 0x4e3 [0053.523] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49d7bfe0 | out: lpCPInfo=0x49d7bfe0) returned 1 [0053.523] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0053.523] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b70 | out: hHeap=0x1d0000) returned 1 [0053.524] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e9b00 | out: hHeap=0x1d0000) returned 1 [0053.524] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1cd0 | out: hHeap=0x1d0000) returned 1 [0053.524] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e9a80 | out: hHeap=0x1d0000) returned 1 [0053.524] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e98a0 | out: hHeap=0x1d0000) returned 1 [0053.524] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1ab0 | out: hHeap=0x1d0000) returned 1 [0053.524] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e6510 | out: hHeap=0x1d0000) returned 1 [0053.524] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e4610 | out: hHeap=0x1d0000) returned 1 [0053.524] GetProcessHeap () returned 0x1d0000 [0053.524] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e97e0 | out: hHeap=0x1d0000) returned 1 [0053.524] _vsnwprintf (in: _Buffer=0x49d86340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f418 | out: _Buffer="\r\n") returned 2 [0053.524] _get_osfhandle (_FileHandle=1) returned 0xf4 [0053.524] GetFileType (hFile=0xf4) returned 0x3 [0053.524] _get_osfhandle (_FileHandle=1) returned 0xf4 [0053.524] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0053.524] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f3e8, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f3e8*=0x2, lpOverlapped=0x0) returned 1 [0053.524] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0053.524] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d7c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.524] _vsnwprintf (in: _Buffer=0x49d6eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f428 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0053.525] _vsnwprintf (in: _Buffer=0x49d6ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f428 | out: _Buffer=">") returned 1 [0053.525] _get_osfhandle (_FileHandle=1) returned 0xf4 [0053.525] GetFileType (hFile=0xf4) returned 0x3 [0053.525] _get_osfhandle (_FileHandle=1) returned 0xf4 [0053.525] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0053.525] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f418, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f418*=0x26, lpOverlapped=0x0) returned 1 [0053.525] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.525] GetFileType (hFile=0xe8) returned 0x3 [0053.525] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.525] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.525] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0053.525] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.525] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.525] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0053.525] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.525] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.525] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0053.525] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.525] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.525] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0053.525] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.526] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.526] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0053.526] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.526] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.526] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0053.526] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.526] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.526] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0053.526] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.526] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.526] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0053.526] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.526] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.526] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0053.526] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.526] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.526] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0053.526] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.526] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.527] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0053.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.527] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.527] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0053.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.527] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.527] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0053.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.527] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.527] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0053.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.527] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.527] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0053.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.527] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.527] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0053.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.527] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.528] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0053.528] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.528] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.528] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0053.528] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.528] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.528] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0053.528] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.528] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.528] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0053.535] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.535] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.535] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.535] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0053.535] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.535] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.535] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.535] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0053.535] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.535] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.536] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.536] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0053.536] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.536] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.536] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.536] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.536] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.536] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0053.536] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.536] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.536] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.536] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.536] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.536] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.536] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.536] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.536] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.536] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.537] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.537] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.537] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.537] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.537] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.537] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0053.537] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.537] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.537] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.537] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0053.537] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.537] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.537] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.537] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0053.537] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.537] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.537] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.537] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0053.538] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.538] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.538] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.538] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.538] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.538] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.538] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.538] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.538] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.538] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.538] ReadFile (in: hFile=0xe8, lpBuffer=0x49d7c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f718, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesRead=0x14f718*=0x1, lpOverlapped=0x0) returned 1 [0053.538] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d7c320, cbMultiByte=1, lpWideCharStr=0x49d7e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0053.538] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.538] GetFileType (hFile=0xe8) returned 0x3 [0053.538] _get_osfhandle (_FileHandle=0) returned 0xe8 [0053.538] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.538] _get_osfhandle (_FileHandle=1) returned 0xf4 [0053.538] GetFileType (hFile=0xf4) returned 0x3 [0053.538] _get_osfhandle (_FileHandle=1) returned 0xf4 [0053.538] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x49d7c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0053.538] WriteFile (in: hFile=0xf4, lpBuffer=0x49d7c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14f6f8, lpOverlapped=0x0 | out: lpBuffer=0x49d7c320*, lpNumberOfBytesWritten=0x14f6f8*=0x24, lpOverlapped=0x0) returned 1 [0053.538] GetProcessHeap () returned 0x1d0000 [0053.538] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x4012) returned 0x1ef630 [0053.539] GetProcessHeap () returned 0x1d0000 [0053.539] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ef630 | out: hHeap=0x1d0000) returned 1 [0053.539] GetProcessHeap () returned 0x1d0000 [0053.539] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xb0) returned 0x1e97e0 [0053.539] GetProcessHeap () returned 0x1d0000 [0053.539] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x22) returned 0x1e4610 [0053.540] GetProcessHeap () returned 0x1d0000 [0053.540] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x48) returned 0x1eaa90 [0053.540] GetConsoleOutputCP () returned 0x4e3 [0053.544] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49d7bfe0 | out: lpCPInfo=0x49d7bfe0) returned 1 [0053.544] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0053.544] GetConsoleTitleW (in: lpConsoleTitle=0x14f6b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0053.544] GetProcessHeap () returned 0x1d0000 [0053.544] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x218) returned 0x1e9910 [0053.544] GetProcessHeap () returned 0x1d0000 [0053.544] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5a) returned 0x1e9b30 [0053.544] GetProcessHeap () returned 0x1d0000 [0053.544] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x420) returned 0x1e9090 [0053.544] SetErrorMode (uMode=0x0) returned 0x0 [0053.544] SetErrorMode (uMode=0x1) returned 0x0 [0053.544] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1e90a0, lpFilePart=0x14ef40 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14ef40*="Desktop") returned 0x25 [0053.544] SetErrorMode (uMode=0x0) returned 0x1 [0053.544] GetProcessHeap () returned 0x1d0000 [0053.545] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e9090, Size=0x6e) returned 0x1e9090 [0053.545] GetProcessHeap () returned 0x1d0000 [0053.545] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e9090) returned 0x6e [0053.545] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0053.545] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0053.545] GetProcessHeap () returned 0x1d0000 [0053.545] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x128) returned 0x1e5b70 [0053.545] GetProcessHeap () returned 0x1d0000 [0053.545] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x240) returned 0x1d1ab0 [0053.545] GetProcessHeap () returned 0x1d0000 [0053.545] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d1ab0, Size=0x12a) returned 0x1d1ab0 [0053.545] GetProcessHeap () returned 0x1d0000 [0053.545] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1d1ab0) returned 0x12a [0053.545] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d6f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0053.545] GetProcessHeap () returned 0x1d0000 [0053.545] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xe8) returned 0x1e9db0 [0053.545] GetProcessHeap () returned 0x1d0000 [0053.545] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e9db0, Size=0x7e) returned 0x1e9db0 [0053.545] GetProcessHeap () returned 0x1d0000 [0053.545] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e9db0) returned 0x7e [0053.545] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0053.545] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0xffffffffffffffff [0053.545] GetLastError () returned 0x2 [0053.545] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0xffffffffffffffff [0053.546] GetLastError () returned 0x2 [0053.546] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0053.546] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0x1e9ba0 [0053.546] FindClose (in: hFindFile=0x1e9ba0 | out: hFindFile=0x1e9ba0) returned 1 [0053.546] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0xffffffffffffffff [0053.546] GetLastError () returned 0x2 [0053.546] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x14ecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb0) returned 0x1e9ba0 [0053.546] FindClose (in: hFindFile=0x1e9ba0 | out: hFindFile=0x1e9ba0) returned 1 [0053.546] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0053.546] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0053.546] GetConsoleTitleW (in: lpConsoleTitle=0x14f200, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0053.547] GetProcessHeap () returned 0x1d0000 [0053.547] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x21c) returned 0x1e9110 [0053.547] GetConsoleTitleW (in: lpConsoleTitle=0x1e9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0053.547] GetProcessHeap () returned 0x1d0000 [0053.547] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e9110, Size=0xc0) returned 0x1e9110 [0053.547] GetProcessHeap () returned 0x1d0000 [0053.547] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e9110) returned 0xc0 [0053.547] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0053.547] GetProcessHeap () returned 0x1d0000 [0053.547] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e9110 | out: hHeap=0x1d0000) returned 1 [0053.547] InitializeProcThreadAttributeList (in: lpAttributeList=0x14efb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ef78 | out: lpAttributeList=0x14efb8, lpSize=0x14ef78) returned 1 [0053.547] UpdateProcThreadAttribute (in: lpAttributeList=0x14efb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ef68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14efb8, lpPreviousValue=0x0) returned 1 [0053.547] GetStartupInfoW (in: lpStartupInfo=0x14f0d0 | out: lpStartupInfo=0x14f0d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0053.548] GetProcessHeap () returned 0x1d0000 [0053.548] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1e4640 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0053.548] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0053.549] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0053.549] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0053.549] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0053.549] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0053.549] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0053.549] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0053.549] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0053.549] GetProcessHeap () returned 0x1d0000 [0053.549] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e4640 | out: hHeap=0x1d0000) returned 1 [0053.549] GetProcessHeap () returned 0x1d0000 [0053.549] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x12) returned 0x1e8900 [0053.549] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14eff0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14efa0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x14efa0*(hProcess=0x50, hThread=0x54, dwProcessId=0xa84, dwThreadId=0xa88)) returned 1 [0054.560] CloseHandle (hObject=0x54) returned 1 [0054.560] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0054.560] GetProcessHeap () returned 0x1d0000 [0054.561] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eeb10 | out: hHeap=0x1d0000) returned 1 [0054.561] GetEnvironmentStringsW () returned 0x1eeb10* [0054.561] GetProcessHeap () returned 0x1d0000 [0054.561] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xb0e) returned 0x1ef630 [0054.561] FreeEnvironmentStringsW (penv=0x1eeb10) returned 1 [0054.561] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e8a8, ReturnLength=0x0) returned 0x0 [0054.561] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x14e8e0, nSize=0x380, lpNumberOfBytesRead=0x14e8a0 | out: lpBuffer=0x14e8e0*, lpNumberOfBytesRead=0x14e8a0*=0x380) returned 1 [0054.561] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x43833000" os_pid = "0xa54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa28" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xa58 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x3e144000" os_pid = "0xa84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa28" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0xa88 Thread: id = 22 os_tid = 0xa98 Thread: id = 23 os_tid = 0xa9c Thread: id = 24 os_tid = 0xaa0 Thread: id = 25 os_tid = 0xaa4 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x33a79000" os_pid = "0xaa8" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0xa84" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00077ef3" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0xac4 Thread: id = 27 os_tid = 0xac0 Thread: id = 28 os_tid = 0xabc Thread: id = 29 os_tid = 0xab8 [0066.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xddd9e0 | out: lpSystemTimeAsFileTime=0xddd9e0*(dwLowDateTime=0x219194c0, dwHighDateTime=0x1d5157a)) [0066.222] GetCurrentProcessId () returned 0xaa8 [0066.222] GetCurrentThreadId () returned 0xab8 [0066.222] GetTickCount () returned 0x1c8d9 [0066.222] QueryPerformanceCounter (in: lpPerformanceCount=0xddd9e8 | out: lpPerformanceCount=0xddd9e8*=18572506893) returned 1 [0066.222] malloc (_Size=0x100) returned 0x488e80 Thread: id = 30 os_tid = 0xab4 Thread: id = 31 os_tid = 0xab0 Thread: id = 32 os_tid = 0xaac Thread: id = 33 os_tid = 0xac8 Thread: id = 40 os_tid = 0xb64 Thread: id = 41 os_tid = 0x5d0 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2a37e000" os_pid = "0xacc" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xaa8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:000789ce" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 34 os_tid = 0xaf8 Thread: id = 35 os_tid = 0xae4 Thread: id = 36 os_tid = 0xae0 Thread: id = 37 os_tid = 0xadc Thread: id = 38 os_tid = 0xad8 Thread: id = 39 os_tid = 0xad0 Thread: id = 42 os_tid = 0x644